4.17.0-0.nightly-multi-2026-11-11-152102

PullSpec:

quay.io/openshift-release-dev/ocp-release-nightly@sha256:9fa6df59abbf19815fa2dc77e7fb09100077f5cc17ee108fb86fff94115a2025

Qualifiers (status api): None

Tests:

Blocking jobs
- e2e-aws-ovn-multi-x-ax Succeeded periodic-ci-openshift-multiarch-main-nightly-4.17-ocp-e2e-aws-ovn-multi-x-ax
Informing jobs
- e2e-aws-ovn-minor-upgrade-multi-a-a Succeeded periodic-ci-openshift-multiarch-main-nightly-4.17-ocp-e2e-upgrade-aws-ovn-multi-a-a
- e2e-nightly-upgrade-aws-ovn-multi-a-a Succeeded periodic-ci-openshift-multiarch-main-nightly-4.17-ocp-e2e-upgrade-aws-ovn-multi-a-a

Upgrades from:

Upgrades to:

4.17.0-0.nightly-multi-2026-11-12-032102 (changes) - Success

Loading changelog, this may take a while ...

Changes from 4.16.0-0.nightly-multi-2026-11-11-040407

Created: 2026-11-11 15:58:45 +0000 UTC

Image Digest: sha256:b34b30109c7c9fbfbc34daf925e5ffec8301a8801451f6c9e6f633ca9ea547a0

Components

Kubectl upgraded from 1.29.7 to 1.30.5
Kubernetes upgraded from 1.29.14 to 1.30.14
Kubernetes Tests upgraded from 1.29.0 to 1.30.14
Red Hat Enterprise Linux CoreOS upgraded from 416.94.202611091854-0 to 417.94.202611091829-0 (diff)

FeatureGate Changes

FeatureGate	Default Hypershift	Default SelfManagedHA	DevPreviewNoUpgrade Hypershift	DevPreviewNoUpgrade SelfManagedHA	TechPreviewNoUpgrade Hypershift	TechPreviewNoUpgrade SelfManagedHA
ClusterAPIInstallAzure (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled (Changed)	Enabled (Changed)	Enabled (Changed)	Enabled (Changed)
ImagePolicy (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ServiceAccountTokenNodeBindingValidation (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ServiceAccountTokenPodNodeInfo (0 tests)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)	Unconditionally Enabled (Changed)
ChunkSizeMiB (5 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ClusterAPIInstallGCP (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ClusterAPIInstallPowerVS (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
GCPLabelsTags (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ManagedBootImages (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
NodeDisruptionPolicy (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
ValidatingAdmissionPolicy (0 tests)	Enabled (Changed)	Enabled (Changed)	Enabled	Enabled	Enabled	Enabled
AWSEFSDriverVolumeMetrics (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
IngressControllerLBSubnetsAWS (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MultiArchInstallAWS (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MultiArchInstallGCP (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
SetEIPForNLBIngressController (0 tests)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
AdditionalRoutingCapabilities (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
BootcNodeManagement (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ClusterMonitoringConfig (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MachineAPIMigration (0 tests)
ManagedBootImagesAWS (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
MultiArchInstallAzure (0 tests)
NetworkSegmentation (28 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
OVNObservability (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
PersistentIPsForVirtualization (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
ProcMountType (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
RouteAdvertisements (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)
UserNamespacesSupport (0 tests)			Enabled (New)	Enabled (New)	Enabled (New)	Enabled (New)

New images

baremetal-cluster-api-controllers git 41b34248 sha256:5708d0170e3662117cbd884f64dc2789b43b8e119fff1d5bb2d66443660959da
gcp-workload-identity-federation-webhook git 653b08cc sha256:9f83d74023067b576a2f0cfcc70095a64dd43391d566b6f99457d0367f5e96b9
metallb-frr git b575d5df sha256:feb3f4acbfc3ff2b9f2fe2fa749a4aabe9bbb68f1d369bbb9bf1631803a5ac3b
networking-console-plugin git 4412fa1f sha256:6df4c990cdf86714bae29dbd2d48dc13446b76a8b90ec9aa49b379b3eaaf0774

Removed images

alibaba-cloud-controller-manager
alibaba-machine-controllers
k8s-prometheus-adapter
olm-rukpak
sdn

Rebuilt images without code change

rhel-coreos sha256:0400993b9746b0305decbe8d884f0254e3e144f6cada2adde63ca0663b13b8d5
rhel-coreos-extensions sha256:8f64598bb2750fe7a98323d5dbce2c7e71c35f942282d52c5ae688254d3695ee

agent-installer-api-server

OCPBUGS-89875: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10801
MGMT-23439: Pin gotestsum to v1.12.2 for Go 1.20 compatibility #10016
And 154 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-103137: Bump x/net to v0.35.0-sec.4 #2296
And 18 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-node-agent

OCPBUGS-103143: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1617
And 22 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-utils

OCPBUGS-68141: bump github.com/sirupsen/logrus to v1.9.3 #238
append .0 to go.mod version #110
OCPBUGS-34187: Updating ose-agent-installer-utils-container image to be consistent with ART for 4.17 #35
Full changelog

apiserver-network-proxy

append .0 to go.mod version #82
OCPBUGS-37052: Revert “Agent: Respect HTTPS_PROXY env vars for proxied connections” #57
OCPBUGS-34199: Updating ose-apiserver-network-proxy-container image to be consistent with ART for 4.17 #54
Full changelog

aws-cloud-controller-manager

OCPBUGS-103332: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #172
OCPBUGS-88219: replace golang.org/x/net with sustaining fork v0.35.0-sec.4 #181
append .0 to go.mod version #109
NO-JIRA: Update OWNERS #91
OCPCLOUD-2608: Merge https://github.com/kubernetes/cloud-provider-aws:master (0445cf1) into master #62
OCPBUGS-33979: update for CVE-2023-45288 [release-4.17] #87
OCPBUGS-31572: Ensure that addresses are added in network device index order #86
Full changelog

aws-cluster-api-controllers

OCPBUGS-103142: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #653
OCPBUGS-130953: Fix OIDC test certificate thumbprint #663
🌱 OCPBUGS-123711: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #644
OCPBUGS-78175: [release-4.17] update go mod dependency for konflux #590
OCPBUGS-61940: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #571
OCPBUGS-58669, OCPBUGS-58674: bump github.com/golang/glog to v1.2.5 #559
OCPBUGS-53727: bump to github.com/golang-jwt/jwt/v4@v4.5.2 #546
OCPBUGS-51309: UPSTREAM: 5339: Bump glog for recent fixes #539
OCPBUGS-43921: OSD-25934: Only tag NetworkInterfaces in RunInstances if IAM Allows It #528
OCPCLOUD-2679: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.6.1 (6db1244) into master #519
NO-JIRA: Update OWNERS #517
OCPBUGS-34382: Updating ose-aws-cluster-api-controllers-container image to be consistent with ART for 4.17 #515
OCPCLOUD-2620: Merge https://github.com/kubernetes-sigs/cluster-api-provider-aws:v2.5.0 (fb221b1) into master #512
Full changelog

aws-ebs-csi-driver

OCPBUGS-90292: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.6 #353
OCPBUGS-82699: Address CVE-2026-35469 #328
OCPBUGS-86234: UPSTREAM: 2367: cleanup: make verify should ignore copyright year #323
OCPBUGS-80031: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 #314
STOR-1598: Rebase to v1.32.0 for OCP 4.17 #272
OCPBUGS-36943: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 4.17 #273
OCPBUGS-34232: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 4.17 #268
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator

OCPBUGS-103305: Use patched x/net fork v0.35.0-sec.4 #631
OCPBUGS-103147, OCPBUGS-103155: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #609
OCPBUGS-80133: Bump google.golang.org/grpc #543
OCPBUGS-64704: Use 127.0.0.1 for healtz http-endpoints #462
OCPBUGS-63557: Add RBAC ClusterRole and Binding for driver node #453
OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449
OCPBUGS-60597: Bump library-go to fix assignment to nil map issue #422
OCPBUGS-60470: Backport stale conditions fix #416
OCPBUGS-46512: remove EFS driver metrics #350
OCPBUGS-44974: Set separate secrets for file and disk config on HyperShift #331
OCPBUGS-42949: add tag matching to Azure File storage class #291
OCPBUGS-43789: add ability to control kube rbac proxy container image… #310
OCPBUGS-42997: Correct aws efs csi driver config as removable #296
OCPBUGS-38355: Bump openshift/api to get EFS volume metrics #274
OCPBUGS-38736: Some CSI driver containers missing terminationMessagePolicy #263
OCPBUGS-38815: add init container in EFS CSI controller pod #265
OCPBUGS-38355: Volume Metrics for EFS CSI Driver #257
STOR-1819: Add manifest with OCP specific test config #254
NO-JIRA: use service account namespace placeholder for smb role bindings #250
STOR-2002: add Azure File snapshot support #253
OCPBUGS-37488: add init container in EBS CSI controller pod #248
STOR-1856: add STS hook for EFS credentials request controller #251
STOR-1874: Use real HyperShift API #236
OCPBUGS-37274: Add FIPS_ENABLED to env vars for aws-efs-csi-driver (2) #249
STOR-1856: remove aws efs operator legacy dir #244
STOR-1596: Bump all deps for 4.17 #240
STOR-1856: STOR-1606: migrate legacy AWS EFS operator code to csi-operator #237
OCPBUGS-36936: Updating ose-smb-csi-driver-operator-container image to be consistent with ART for 4.17 #241
OCPBUGS-36948: Updating ose-azure-disk-csi-driver-operator-container image to be consistent with ART for 4.17 #243
OCPBUGS-36942: Updating ose-azure-file-csi-driver-operator-container image to be consistent with ART for 4.17 #242
STOR-1606: Bump OLM metadata to 4.17 #239
OCPBUGS-34451: Bump go version to be consistent with ART #238
STOR-1290: don’t pass credentials via environment variables in AWS EBS #202
STOR-1856: migrate AWS EFS operator to csi-operator #232
NO-JIRA: keep smb test storageclass consistent with official doc #234
OCPBUGS-34667: Ensure Node Metric Service is created in the openshift-cluster-csi-drivers namespace for both OpenShift and Hypershift #233
OCPBUGS-34189: Updating ose-aws-ebs-csi-driver-operator-container image to be consistent with ART for 4.17 #227
OCPBUGS-32370: Configure scraping of node metrics #223
OCPBUGS-33776: Adjust port for registrar sidecar in aws-ebs csi driver container #225
Full changelog

aws-kms-encryption-provider

OCPBUGS-80009: Bump google.golang.org/grpc to v1.79.3 #44
OCPBUGS-34314: Updating aws-kms-encryption-provider-container image to be consistent with ART for 4.17 #19
hack: display diff on verify-mod-tidy failure #25
NO-JIRA: Bump to latest #20
Full changelog

aws-machine-controllers

OCPBUGS-73822: Fix reconciler consistency checks in Update and Exists #167
OCPBUGS-63139: client: re-use a single file for building the session instead of randomly named files #145
OCPBUGS-45186: fix Associate*IpAddress flag when launch EC2 #118
OCPCLOUD-2565: Add feature gates flag #108
OCPBUGS-36469: Update placementGroupPartition to honour it as a pointer #107
CFE-1064: Add support for PlacementGroupPartition of placement group #101
NO-JIRA: Update OWNERS #105
OCPCLOUD-2615: Update dependencies to K8s 1.30 #104
OCPBUGS-34255: Updating ose-machine-api-provider-aws-container image to be consistent with ART for 4.17 #103
Full changelog

aws-pod-identity-webhook

OCPBUGS-51232: github.com/go-jose/go-jose/v4 v4.0.5 #202
OCPBUGS-36522: Rename Dockerfile #195
OCPBUGS-34147: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART for 4.17 #194
OCPBUGS-34147: Updating ose-aws-pod-identity-webhook-container image to be consistent with ART for 4.17 #193
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-103148, OCPBUGS-103330: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #209
OCPBUGS-80035, OCPBUGS-80036, OCPBUGS-80174: Bump google.golang.org/grpc to v1.79.3 #181
OCPBUGS-46039: Prevent panic when informer receives cache.DeletedFinalStateUnknown #132
NO-JIRA: Update OWNERS #123
OCPCLOUD-2607: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (e6f5e9a) into master #113
Full changelog

azure-cluster-api-controllers

OCPBUGS-80037: Bump google.golang.org/grpc to v1.79.3 #386
OCPBUGS-77983: [release-4.17] update go mod dependency for konflux #363
OCPCLOUD-2584: Add manifest generation #300
OCPBUGS-34246: Updating ose-azure-cluster-api-controllers-container image to be consistent with ART for 4.17 #312
OCPBUGS-36026: Update go-retryablehttp to v0.7.7 #309
NO-JIRA: Update OWNERS #308
OCPCLOUD-1640: Add DisableExtensionOperations field #301
OCPCLOUD-2621: Merge https://github.com/kubernetes-sigs/cluster-api-provider-azure:v1.15.0 (e1f1f75) into master #305
Full changelog

azure-disk-csi-driver

OCPBUGS-103158: Bump golang.org/x/net to v0.35.0-sec.4 #173
OCPBUGS-80038: Address CVE-2026-33186 #143
STOR-1601: Rebase to upstream v1.29.7 for OCP 4.17 #81
OCPBUGS-36939: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 4.17 #83
OCPBUGS-34111: Updating ose-azure-disk-csi-driver-container image to be consistent with ART for 4.17 #79
Full changelog

azure-file-csi-driver

OCPBUGS-103162: Bump golang.org/x/net to v0.35.0-sec.4 #159
OCPBUGS-92849: Bump golang.org/x/crypto to v0.33.0-sec.3 #149
OCPBUGS-80041: Bump google.golang.org/grpc to v1.79.3 #130
OCPBUGS-38669: bump mount-utils to treat ENODEV error as corrupted mount #75
STOR-2002: UPSTREAM: 2040: fix snapshot size #73
STOR-1604: Rebase v1.30.3 for OCP 4.17 #70
OCPBUGS-34464: Updating ose-azure-file-csi-driver-container image to be consistent with ART for 4.17 #72
Full changelog

azure-kms-encryption-provider

OCPBUGS-80010: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #47
append .0 to go.mod version #19
OCPBUGS-53495: bump golang-jwt v4 #12
OCPBUGS-34277: Updating azure-kms-encryption-provider-container image to be consistent with ART for 4.17 #7
OCPBUGS-33805: Use exec form entrypoint #5
Full changelog

azure-machine-controllers

OCPBUGS-103260: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #214
OCPBUGS-65954: Set updateDomainCount to one when faultDomainCount is one #176
OCPBUGS-63700: Support datadisks on Stack Hub #168
OCPBUGS-56168: [release-4.17] Update virtualmachines service to armcompute/v5 SDK #146
OCPBUGS-56655: Fix failure when attempting to modify immutable availabilitySet #152
OCPBUGS-55729: Update eviction policy for Spot VMs from Deallocate to Delete #140
OCPBUGS-54393: Re-reconcile machine on NIC provisioning failure #136
OCPBUGS-52359: Remove unused vnet package #130
OCPBUGS-50017: dynamically setting the amount of fault domains #127
OCPCLOUD-2565: Adds –feature-gates CLI argument #116
NO-JIRA: Update OWNERS #114
OCPCLOUD-2614: Update to K8s 1.30 #113
OCPBUGS-34184: Updating ose-machine-api-provider-azure-container image to be consistent with ART for 4.17 #108
CFE-1050: Add support of capacity reservation group in openshift/machine-api-provider-azure #107
Full changelog

azure-workload-identity-webhook

OCPBUGS-103156: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #64
OCPBUGS-53799: github.com/golang-jwt/jwt/v4 v4.5.2 #32
OCPBUGS-51234: github.com/go-jose/go-jose/v4 v4.0.5 #28
OCPBUGS-36402: Rename Dockerfile.rhel7 to Dockerfile.ocp #23
OCPBUGS-34208: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.17 #22
OCPBUGS-34208: Updating ose-azure-workload-identity-webhook-container image to be consistent with ART for 4.17 #21
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-103154: Bump golang.org/x/net to v0.35.0-sec.4 #10972
OCPBUGS-89851, OCPBUGS-89856, OCPBUGS-89859, OCPBUGS-92861: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10906
OCPBUGS-127575: Update gcloud version to one that can be found #10917
OCPBUGS-77898: Update RHCOS-release-4.17 bootimage metadata to 417.94.202607240132-0 #10796
OCPBUGS-67204: Update the RHCOS 4.17 bootimage metadata #10285
OCPBUGS-77791: [Release 4.17] pkg/asset/manifests/azure: save cidr blocks #10218
OCPBUGS-74677: [release-4.17] GCP: skip AI zones #10276
OCPBUGS-74555: Azure UPI ARM template: use storageAccountId #10264
OCPBUGS-68142: [4.17] uplift logrus #10167
OCPBUGS-53236: Validation for API and Ingress VIPs when using user-managed load balancer #10047
OCPBUGS-62951: Update the RHCOS 4.17 bootimage metadata #10021
OCPBUGS-62054: Make swift containers removal not fatal for UPI. #9952
OCPBUGS-54599: Update the RHCOS 4.17 bootimage metadata #9902
OCPBUGS-58319: vSphere - remove unit tests using nip.io #9821
OCPBUGS-57293: sort zone slices extracted from map of byo subnets #9778
OCPBUGS-56448: vsphere - check if host is powered down or on standby before uploading template #9726
OCPBUGS-57292: ensure ctrplane nodes can access bootstrap MCS #9775
OCPBUGS-57304: IBI nmstate unit test fix #9777
OCPBUGS-55224: Fix Load balancer IP setup #9675
OCPBUGS-51116: update resolv.conf every time on bootstrap node #9504
OCPBUGS-51210: Fixes panic during GCP tags fetch due to unstable network #9512
OCPBUGS-46375: Allow spaces in the aws tags [release-4.17] #9315
OCPBUGS-54357: IBMCloud: Move to IBM TF openshift fork #9613
OCPBUGS-53378: Remove error logging when determining image arch #9581
OCPBUGS-53459: aws: fix NLB creation in secret regions #9071
OCPBUGS-52961: Remove tmp directory used for agent pxe files #9552
OCPBUGS-43528: Prevent race with provisioning-interface service #9110
OCPBUGS-44058: Log correct hostname for validation status #9162
OCPBUGS-50967: PowerVS: destroy dhcp hack #9494
OCPBUGS-50846: OCPBUGS-50702: [release-4.17] MGMT-19771: Convert IDS to proper IDMS manifest #9470
OCPBUGS-50876: correct typo #9484
OCPBUGS-49975: aws/edge/byovpc: subnets tag kube cluster tag to shared #9445
OCPBUGS-48761: Update RHCOS 4.17 bootimage metadata to 417.94.202501301529-0 #9448
OCPBUGS-49993: Disable IP Forwarding for CAPG Machines #9446
OCPBUGS-41300: Azure: Update SecurityType passed in at Image creation #9409
OCPBUGS-49362: [Nutanix] Installation failed with timeout when uploading images to PC #9406
OCPBUGS-48645: azure: use separate /var to avoid growfs timeouts #9381
OCPBUGS-45340: move GCP zone filtering client-side #9264
OCPBUGS-48257: remove the types which failed by RHEL-59521 and add the new gpu vm type #9354
OCPBUGS-45813: Remove unused variable from ASH arm template 06_workers.json #9285
OCPBUGS-48359: Allow more time for Service Account Creation #9362
OCPBUGS-45344: support additionalNTPSources in node-joiner tool #9265
OCPBUGS-48119: Always set AllowCrossTenantReplication parameter to false #9346
OCPBUGS-46432: Power VS: Create region-zone-sysType hierarchy #9319
OCPBUGS-46360: aws: add ec2:AllocateAddress perm requirement. #9313
no-jira: Collect bootstrap logs when control plane provisioning fails #9308
OCPBUGS-45726: IBMCloud: Add service overrides #9267
OCPBUGS-42117: Remove destroy search for regional target tcp proxies #9025
OCPBUGS-45484: PowerVS: Listen to machineNetwork #9271
OCPBUGS-44848: aws: user right perm for untagging BYO IAM profiles #9228
OCPBUGS-45276: Bump Azure Machine Timeout #9257
ARO-12457: Include bootstrap docker config file in go module #9258
OCPBUGS-43047: fix slice init length #9089
OCPBUGS-43800: pkg/asset/installconfig/azure: send full certifcate chain #9140
CORS-3753: Allow mocking of the Azure client everywhere #9219
OCPBUGS-44611: [release-4.17] capi/aws: set Node Port Service CIDR override #9209
OCPBUGS-44230: Add C4A instance types #9181
OCPBUGS-44231: [release-4.17] capi/aws: bump provider for LB DNS lookup fix #9179
OCPBUGS-44261: Ensure rendezvousIP is checked against host IP #9184
OCPBUGS-43972: Cherrypick oci ccm fix to 4.17 #9152
OCPBUGS-44247: PowerVS: Update 4.17 CAPI ibmcloud to 9b077049 #9182
OCPBUGS-41642: vendor: Update openshift/api to pick up v4.17 capability sets #9013
OCPBUGS-44226: PowerVS: Fix MissingSecurityGroupRules #9175
OCPBUGS-44227: PowerVS: Fix destroy persistent TG #9176
OCPBUGS-44228: PowerVS: Change CAPI verbosity level #9177
OCPBUGS-43846: add chrony.conf file when additional NTP sources are configured #9142
OCPBUGS-43735: Add C4 instance validation #9130
OCPBUGS-43897: Revendor assisted service external platform oci #9147
OCPBUGS-43786: Limit GCP API firewall rule for internal clusters #9138
OCPBUGS-43547: Power VS: Fix incorrect error handling for AddSecurityGroupRule #9112
OCPBUGS-43088: GCP Validate Disk and Instance Type #9091
OCPBUGS-43329: IBMCloud: Handle pagination for subnets #9096
OCPBUGS-42716: Update RHCOS 4.17 bootimage metadata to 417.94.202410090854-0 #9092
OCPBUGS-42806: gather: simplify service regex for analyze #9079
OCPBUGS-42996: Power VS Ensure Metadata populated for CAPI/private cluster case on PowerVS #9086
OCPBUGS-42115: Add validation for gcp disk and instance types #9023
OCPBUGS-42842: add new tested azure instance types detected during QE 4.17 full function test #9080
OCPBUGS-41812: Validate MTU for custom network #9084
OCPBUGS-42794: PowerVS: Add support for persistent Transit Gateways #9078
OCPBUGS-42699: machines: don’t sort mpool zones #9065
OCPBUGS-42483: PowerVS: update capi ibmcloud c6bcd313 for 4.17 #9054
OCPBUGS-39414: OpenStack: Install CI dependencies from rpm #8994
OCPBUGS-42142: Skip private managed zone creation for xpn installs #9033
OCPBUGS-42183: Add GCP N4 Machine Series to tested instances for OCP #9041
OCPBUGS-42126: add tested IBMCloud instance types in 4.17 test #9030
OCPBUGS-42118: Set default release image to 4.17 #9026
OCPBUGS-42116: Remove bindings for XPN installs #9024
OCPBUGS-39409: Fix IPv6 security group rule for schedulable master #8970
OCPBUGS-41622: update RHCOS 4.17 bootimage metadata to 417.94.202409120353-0 #9019
OCPBUGS-42051: Fix integration tests #9018
OCPBUGS-41300: Azure CAPI: Improve handling of security features configured on the MachinePools and OSDisk #9007
OCPBUGS-39286: Fix var_files syntax to work on older version of ansible #8933
OCPBUGS-41896: Add AWS c7g,m7g,r8g to tested instance types #9005
OCPBUGS-41542: Azure CAPI: Update publicAccess for Blob Containers #9006
OCPBUGS-41702: aws: bump capa to fix EIP leak on bootstrap when BYOIP #8991
OCPBUGS-38933: install-status reflects day 2 services #8899
OCPBUGS-39239, OCPBUGS-39240: vSphere - If template is defined skip downloading #8926
OCPBUGS-41300: Azure CAPI: Set SecurityType as a Feature while creating Gallery Image #8990
OCPBUGS-41500: Bump extract-machine-os timout to 20m #8981
OCPBUGS-38963: IngressController subnet selection in AWS #8909
OCPBUGS-41542: Azure CAPI: Fix storage account and vhd container public access #8984
OCPBUGS-41539: Pick the next available IP address for internal LB #8980
OCPBUGS-38568: Azure: Add master and worker VM IPs to both the backend pools API LoadBalancer #8968
OCPBUGS-39545, OCPBUGS-39546, OCPBUGS-39547: update vault version to 1.13.10 #8954
OCPBUGS-38568: Azure CAPI: Add check for APIServer OperatorPublishingStrategy #8870
OCPBUGS-41283: update RHCOS 4.17 bootimage metadata to 417.94.202408270355-0 #8975
OCPBUGS-39495: capi/aws/byo-vpc/multi-cidr: fix group rules #8952
OCPBUGS-39433: dropping this warning as the move from terraform is transparent to the end user #8950
OCPBUGS-38752: Remove firewall rules created by CAPG #8948
OCPBUGS-38738: pkg/infrastructure/azure: set correct cloud for BYO vnet #8972
OCPBUGS-39308: Fix to validation for GCP pre-created ServiceAccount #8931
OCPBUGS-39467: Enable TLS for virtual media in initial ironic deployment #8947
OCPBUGS-39092: Use infrastructure resource to retrieve platform type #8914
OCPBUGS-38934: failed to install Nutanix OCP 4.16 cluster with DHCP network #8900
OCPBUGS-38841: ic: validate release arch is compatible with cluster arch #8895
OCPBUGS-38600: GCP Global Address failed to destroy #8884
OCPBUGS-38616: incorrect folder gen, workaround govmomi vm folder path bug #8867
OCPBUGS-39002: Add new disk types GCP Control Plane nodes #8903
OCPBUGS-38301: upi/aws: update lambda runtime python version #8896
OCPBUGS-38832: aws: validate public-only subnets configs #8893
OCPBUGS-38497: vsphere, if secureboot is enabled, disable it in the template #8841
OCPBUGS-38560: import failure when esxi config is not the same in the cluster #8857
OCPBUGS-38604: Updated powercli configuration to allow multi vcenters #8865
OCPBUGS-38738: CAPZ USGovernmentCloud fixes #8885
OCPBUGS-38534: Resource deletion is holding up deletion process #8849
OCPBUGS-38677: upstream capv bug causes session timeout #8874
OCPBUGS-38246: Add roles needed for shared VPC #8866
OCPBUGS-38692: aws: add support for clusters with public-only subnets #8878
OCPBUGS-38700: pkg/infrastructure/azure: limit storage account to 24 characters or less #8879
OCPBUGS-38602: pkg/asset/machines: fix Azure zones #8862
OCPBUGS-38730: Fix typo #8881
OCPBUGS-38488: AGENT-938: Enhance console logging to display node ISO expiry date during addNodes workflow #8839
OCPBUGS-38569: only allow a single network in failure domain topology #8859
OCPBUGS-38604: Enhanced vSphere UPI scripts for multi vcenter support #8863
OCPBUGS-38387: aws: do not allow edge pools of different arch #8828
OCPBUGS-38244: Do not create firewall rules for xpn installs #8847
OCPBUGS-38447: [release-4.17] bump capa for instance register fix #8836
OCPBUGS-38439: PowerVS: Fix mad system pool #8834
OCPBUGS-38393: [release-4.17] CFE-920: Update GCP userLabels and userTags configs description #8821
OCPBUGS-38356: Update control plane tags to match CAPI networks #8823
AGENT-944: Enable assisted-service debug logging #8816
OCPBUGS-37770: data/bootstrap/files/usr/local/bin/bootkube: Pass CVO render –feature-gate-manifest-path #8813
OCPBUGS-37821: Remove timed context for gcp client #8792
CORS-3575: Azure: remove azure terraform code and resources #8764
OCPBUGS-37540: Gather Azure Logs through load balancer #8812
AGENT-937: Check Authentication Token for Node Boot-Up on day2 #8802
Revert “Revert #8221 “SPLAT-1553: Added multi vCenter support for capi installer.”” #8638
MULTIARCH-4770: MULTIARCH-4776: bump o/api for MultiArchInstall FGs #8808
MULTIARCH-4098: Power VS: Make CAPI the default deployment method #8814
CORS-3617: Make Azure CAPI the default (& only) install option #8809
no-jira: PowerVS: Block disconnected deploys in 4.17 #8798
CORS-3608: aws: deprecate platform.aws.amiID field #8755
NO-ISSUE: Remove unnecessary code #8805
AGENT-890: Simplify Agent ISO kargs setting #8513
CORS-3546: Nutanix: add gpus and dataDisks support #8765
OCPBUGS-38055: fix/aws/edge: IAM profile must be same of workers #8803
CORS-3594: MOVE GCP CAPI to default feature set #8723
no-jira: doc: minor update to installation doc #8795
AGENT-870: Update AUTH_TYPE #8108
OCPBUGS-37594: pkg/infrastructure/azure: Set architecture when creating gallery image #8800
CORS-3609: aws: support existing IAM instance profiles #8689
MULTIARCH-4828: Pass ServiceEndpoints from install-config to CAPI for PowerVS #8781
MGMT-18364: add image-based installation ISO integration tests #8797
CORS-3565: CAPZ private clusters #8732
OCPBUGS-36361: Azure: If credentialsMode is manual, pass the identity through #8786
CORS-3299: Azure: Use Customer Managed Key to enable Storage Account Encryption #8736
MULTIARCH-4770: bump o/api for MultiArchInstall TechPreview gates #8791
OCPBUGS-34953: fix bogus analyze message when gather fails #8787
AGENT-928: allow user to specify sshKey via config file #8779
OCPBUGS-35262: Upgrade to latest cluster-api-provider-gcp #8780
AGENT-862: Change day-2 monitor timeout back to 90 minutes #8783
AGENT-919: Authenticate day2 operations #8717
OCPBUGS-35959: azure: Fix Accelerated network enablement #8667
CORS-3209: Set UserTags on CAPG resources #8691
no-jira: bootstrap: add shellcheck directives to follow sourced files #8741
CORS-3580: Update GCP Disk Types #8773
no-jira: Azure: remove stale DNS migration images #8775
OCPBUGS-37217: CAPI GCP - retry SetIAMPolicy #8763
OCPBUGS-37427: bootstrap gather fails in vsphere, only ipv6 address used #8759
OCPBUGS-37356: vSphere validation fails if dc is in a folder #8758
OCPBUGS-35366: Update upi references to api-internal #8582
AGENT-862: Extend monitor-add-nodes to support multiple nodes #8507
AGENT-854: day2 add-nodes workflow validations #8740
AGENT-900: enable fips for add-nodes workflow #8760
CORS-3568: Support GCP pre-created Service Accounts for CAPG #8750
OCPBUGS-36302: pkg/asset/machines/azure: Don’t set disk encryption set to nil #8756
OCPBUGS-36780: ic: fix typo in warning message #8744
OCPBUGS-36913: openstack: Fix security group tagging #8757
OCPBUGS-36390: aws: do not require create permissions when BYO IAM role #8688
MULTIARCH-4814: ic: add release arch validation for multi-arch clusters #8761
AGENT-922: Remove misleading inClusterConfig warning #8715
OCPBUGS-36904: aws: bump CAPA for subnet tagging fix #8730
no-jira: Replace Equal with ErrorContains for image-based nmstatectl unit tests #8762
OCPBUGS-37226: Persist image-based config manifests from state instead of template #8752
MGMT-18364: Add image-based config ISO integration tests #8737
OCPBUGS-36917: openstack: Fix apiVIPs and ingressVIPs docs #8728
no-jira: docs/user/azure: fix byo vnet security groups #8485
CORS-3607: Azure CAPI Installs within Tech Preview featureset #8754
MULTIARCH-4777: gcp: support multi-arch nodes #8701
OCPBUGS-35406: Use service CIDRs to determine bootstrap kubelet IP family #8681
AGENT-910: node-joiner multi-arch support #8644
METAL-1039: Allow baremetal platform without MAPI #8521
CORS-3569: UDR for Capz #8731
MULTIARCH-4569: aws: support multi-arch nodes #8698
no-jira: Revert “Merge pull request #8714 from r4f4/bump-default-release-4.17” #8753
OCPBUGS-37104: openstack: Validate controlPlanePort has subnet #8739
OCPBUGS-37164: Handle empty config for image-based create image #8745
OCPBUGS-37107: Power VS: Disable SNAT when specifying imageContentSources #8697
STOR-1353: Attempt to cleanup GCP Filestore instances on destroy #8699
CORS-3073: azure: Allow for installs in existing vnets #8662
MGMT-17842: Add image-based installer create config ISO #8514
MGMT-17226: Add image-based installer create installation ISO #8679
OCPBUGS-35440: capi/aws: bump provider for ingress rules fix #8596
OCPBUGS-34638: destroy/gcp: set value for DiscardLocalSsd #8649
CORS-3302: port forward SSH to bootstrap host #8669
OCPBUGS-36713: CAPG use existing subnets and VPC #8722
MGMT-17226: Add imagebased installer skeleton #8709
CORS-3485: Azure: modify control plane outbound LB into submission as an API LB #8652
OCPBUGS-36378: capi: start controllers after WaitGroup is created #8693
CORS-2775: cmd: destroy: remove deprecated github.com/pkg/errors #8720
OCPBUGS-33973: Openstack UPI - Reintroduce unique resource names. #8477
MULTIARCH-4568: Print release image arch and default arch when the payload is multi #8515
CORS-3593: go.mod: bump k8s dependencies #8713
OCPBUGS-35262: Skip firewall rule creation if permission is missing #8706
OCPBUGS-36142: azure: Fix HyperVGeneration for gen2 images. #8666
OCPBUGS-35542: Cleanup capi artifacts #8599
CORS-3590: releaseimage: update default version #8714
AGENT-875: Authenticate agents #8395
OCPBUGS-34708: CORS-3582: capi: remove unused feature gates #8703
OCPBUGS-36660: CORS-3591: 4.17 default channel incorrectly points to stable-4.16 #8708
CORS-3296: CAPG - configure Internal LoadBalancer in the provider #8421
CORS-3547: Upgrade cluster-api-provider-gcp to v1.7 #8700
AGENT-876: Authenticate systemd services and curl requests #8393
SPLAT-1670: install pwsh from ci mirrored image #8643
OCPBUGS-36453: PowerVS: add .ssh directory #8686
OCPBUGS-35262: Fix shared vpc issues with capg installs #8583
AGENT-925: retrieve ignition endpoint to add a new node #8650
OCPBUGS-35752: capi/aws: disable EKS controller in CAPA #8628
OSASINFRA-3402: Use Gophercloud v2.0.0 #8685
AGENT-871: Authenticate wait for #8270
OCPBUGS-36318: update RHCOS 4.17 bootimage metadata to 417.94.202407010929-0 #8690
OCPBUGS-36316: Power VS: Allow pending network for internal publishing strategy #8677
OCPBUGS-36242: vSphere - If the folder pre-exists do not tag #8671
OSASINFRA-3510: Change ‘Generate’ to accept a context #8562
OCPBUGS-36284: Remove etcd store when provisioning fails #8673
OCPBUGS-36092: bump go-retryablehttp for CVE fix #8653
no-jira: Update documentation on libvirt installs for devs #8675
OCPBUGS-36176: PowerVS: Add ibmcloud plugins #8661
OCPBUGS-35382: CAPG marketplace image use for control plane nodes #8665
OCPBUGS-35852: capi: shutdown local controlplane as the last step #8639
OCPBUGS-35188: aws: remove terraform configs #8557
CORS-3435: Create user assigned identity for Azure VM’s #8645
MULTIARCH-4515: Add new files for agent-based installer (LPAR support for s390x) #8536
OCPBUGS-35420: OSASINFRA-1962: openstack: Validate additionalNetworkIDs and additionalSecurityGroupIDs #8592
CORS-3483: Update CAPI and CAPZ versions to set Machine DisableExtensionOperations #8627
OCPBUGS-34978: Power VS: Ensure that VPC has prerequesite resources for private #8532
OCPBUGS-35547: Configured logger for controller-runtime #8641
OSASINFRA-3465: openstack: Update Gophercloud to v2 #8493
CORS-3562: azure: Setting experimental MachinePool featuregate to false #8637
CORS-3434: azure: Skip image upload if env var is set #8283
OCPBUGS-14963: IBMCloud: Ignore failed VPC regions #8556
OCPBUGS-33735: Remove GCP bootstrap ssh firewall rule #8523
OCPBUGS-31275: gcp: Validate install-config examples #8198
no-jira: images: upi-installer image cleanup #8216
OCPBUGS-33702: baremetal: bootstrap: bind icc to localhost #8445
Revert #8221 “SPLAT-1553: Added multi vCenter support for capi installer.” #8630
OCPBUGS-35426: Update cluster-api-provider-openstack to v0.10.3 #8625
OCPBUGS-35523: remove terraform libvirt from the installer #8610
OCPBUGS-30025: fix: changed validation for olm and marketplace #8609
OCPBUGS-35430: Support CAPI provider custom timeouts #8568
OCPBUGS-35533: Fix ethertype for masters service router SG creation #8615
CORS-3265: capz: Add Accelerated Networking #8418
OCPBUGS-35494: capi/aws: allow 6443 for private cluster NLB #8620
OCPBUGS-35530: capi/aws: retry SSH ingress rule removal #8616
OCPBUGS-35400: For GCP, only configure kmsKeyServiceAccount if set #8597
SPLAT-1553: Added multi vCenter support for capi installer. #8221
OCPBUGS-34037: bump github.com/container/images for CVE fix #8564
OCPBUGS-35511: capi aws: append random string in caller ref #8593
SPLAT-1437: CAPI/AWS/BYOIP: supporting Public IPv4 Pool #8175
OCPBUGS-35467: capi/aws: disable CAPA’s TagUnmanagedNetworkResources feature gate #8602
OCPBUGS-33745: save etcd data to its own directory #8424
NO-JIRA: Remove dulek from openstack-{approvers,reviewers} #8413
OCPBUGS-34819: capi/aws: bump provider for fixes #8545
OCPBUGS-34618: vsphere - allow network selection on cluster name #8505
OCPBUGS-35037: aws: delete ignition bucket on bootstrap destroy #8584
OCPBUGS-35293: Add ELB V2 permission to set security groups on API server load balancer #8572
OCPBUGS-34712: add tested instance type for IBMCloud #8549
OCPBUGS-35315: capi: use polling instead of exponential backoff #8522
OCPBUGS-35197: capi/aws: do not set proxy for masters #8570
OCPBUGS-34005: openstack: Attach a bootstrap FIP to the cluster network port #8578
OCPBUGS-35309: Add S3 permission to allow attaching S3 bucket policy #8573
OCPBUGS-33661: capi/aws: rename preserveBootstrapIgnition #8460
OCPBUGS-35180: Prevent multiple invocations on CAPI #8565
OCPBUGS-33681: Cleanup bootstrap resources for capg install #8489
OCPBUGS-34713: AWS remove extra tags from awsmachines for security groups and subnets #8567
OCPBUGS-35041: capi: do not override KUBECONFIG #8542
OCPBUGS-34325: Updating ose-baremetal-installer-container image to be consistent with ART for 4.17 #8559
OCPBUGS-35182: write etcd and kube-apiserver logs #8441
OCPBUGS-34456: bump envtest binaries version #8471
no-jira: hack: bump golangci-lint version #8535
OCPBUGS-34416: Validate OnHostMaintenance and ConfidentialCompute #8541
OCPBUGS-35039: PowerVS: Destroy DHCP in ERROR state #8544
OCPBUGS-34082: baremetal: check if HardwareDetails is nil #8443
OCPBUGS-34368: OCPBUGS-34325: OCPBUGS-34311: OCPBUGS-34221: Bump golang 1.22 #8473
OCPBUGS-34295: wait for ip addresses to be present on machines #8450
OCPBUGS-35099: OCPBUGS-4466: Prevent cluster installation with mismatched worker assets and worker replicas #8370
OCPBUGS-35038: capi/aws: add BootstrapDestroyer guard #8543
OCPBUGS-34915: Add network tags to capg control plane machines #8531
OCPBUGS-35020: capi/aws: don’t use S3 stub for masters #8538
OCPBUGS-33662: aws: don’t always require s3:Delete* permissions #8410
OCPBUGS-34969: Power VS: Add ports needed for private clusters to security group #8530
OCPBUGS-34900: Increase timeout for bootstrap complete #8534
no-jira: Minor updates to fix linting issues. #8529
OCPBUGS-34869: PowerVS: fix AddIPToLoadBalancerPool #8508
MULTIARCH-4640: Add 4 new regions for PowerVS #8484
OCPBUGS-34493: baremetal: Don’t always enable provisioning-interface.service #8491
No-jira: Revert “Cleanup GCP Filestore instances on destroy” #8527
OCPBUGS-33793: Make Ingress capability required for all baselines #8525
OCPBUGS-34692: update RHCOS 4.17 bootimage metadata to 417.94.202405291927-0 #8516
OCPBUGS-33789: [Nutanix] installer intermittent failed at uploading the bootstrap image to PC when CAPI enabled #8468
STOR-1353: Cleanup GCP Filestore instances on destroy #7251
OSASINFRA-3456: OpenStack: do not use trunk for the Machines by default #8497
OCPBUGS-33508: capi/aws: fix setting custom AMI #8466
OCPBUGS-33793: Make Ingress capability required for standalone OpenShift #8502
CORS-3523, CORS-3524: aws: terraform: add spot instance support for masters #8349
OCPBUGS-33410: attach tag to folder,fix folder destroy #8373
OCPQE-22479: add machine series ‘A3’ and ‘C3D’ to ‘Tested instance types for GCP’ #8504
OCPBUGS-33840: Warn before trimming cluster name #8367
OCPBUGS-33234: azure: bump profile used for network #8351
OCPBUGS-33925: tfvars: change asset’s name #8464
OCPBUGS-33561, OCPBUGS-33615: capv - missing cores/socket,disk type #8446
no-jira: Removing unused users from owners aliases #8498
OCPBUGS-30860: Use infrastructure API to detect cluster topology #8429
MGMT-17468: Detect Release Image Arch in a Disconnected Env. #8378
MULTIARCH-4076: PowerVS: Default region bug fix #7862
OCPBUGS-34243: unique AWS HostedZone Caller Ref #8453
OCPBUGS-30516: bump golang-protobuf for CVE fix #8379
no-jira: images: delete Dockerfile.upi.ci.rhel8 #8377
OCPBUGS-33570: Nutanix IPI install with capi failed to set bootType #8454
OCPBUGS-34389: aws/cluster: restrict SSH on private clusters #8462
OCPBUGS-34368: Updating ose-installer-artifacts-container image to be consistent with ART for 4.17 #8459
OCPBUGS-34354: PowerVS: update capi ibmcloud to release 0 8 0 #8458
OCPBUGS-33926: capi/aws: don’t modify BYO role’s policy #8457
OCPBUGS-33912: PowerVS: Use random subnet #8420
OCPBUGS-34221: Updating ose-installer-altinfra-container image to be consistent with ART for 4.17 #8449
OCPBUGS-34311: Updating ose-installer-container image to be consistent with ART for 4.17 #8455
OCPBUGS-34040: Add –dir /tmp to node-joiner-monitor.sh #8444
OCPBUGS-30860: bootstrap: hit readyz when checking LB status #8400
OCPBUGS-33877: bump aws bootstrap destroy timeout #8427
OCPBUGS-33995: PowerVS: Also fill out PlatformSpec for custom endpoints #8439
TRT-1674: 4.17 capi revert 1 #8433
OCPBUGS-33493: Enable leader election for baremetal operator #8391
OCPBUGS-33890: SPLAT-1469: Remove vsphere terraform #8254
CORS-2840: promote capi-installers to default feature set #8416
And 2 elided commits (e.g. from squash or rebase merges)
Full changelog

baremetal-machine-controllers

OCPBUGS-68143: [4.17] uplift logrus #239
OCPBUGS-46646: Bump x/net to 0.33.0 #225
OCPBUGS-34210: Updating baremetal-machine-controller-container image to be consistent with ART for 4.17 #219
OCPBUGS-34210: Updating baremetal-machine-controller-container image to be consistent with ART for 4.17 #217
Full changelog

baremetal-operator

OCPBUGS-77185: Unblock BMH direct deletion when detached annotation is present #462
OCPBUGS-53325: BMO can expose any secret via BMCEventSubscription CRD #406
OCPBUGS-42387: Remove dataImage finalizer if BMH is missing #390
OCPBUGS-49701: Handle HFC for non-redfish HW #395
OCPBUGS-39489: Disallow fetching secrets from namespaces different from the host’s one #377
OCPBUGS-38937: [OCP] Ability to disable agent power off after deployment #371
OCPBUGS-36425: Sync jul 30 #367
NO-ISSUE: Bmo sync jul9 #364
OCPBUGS-35559: Bmo sync jul5 #362
OCPBUGS-29687: Merge upstream #360
OCPBUGS-34318: Updating ose-baremetal-operator-container image to be consistent with ART for 4.17 #357
OCPBUGS-34318: Updating ose-baremetal-operator-container image to be consistent with ART for 4.17 #356
Full changelog

baremetal-runtimecfg

OCPBUGS-103159: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #409
OCPBUGS-71209: Bump logrus version #377
OCPBUGS-60112: Re-add ENABLE_NODEIP_DEBUG env var #363
OCPBUGS-48766: Extend haproxy-monitor fall time #340
OCPBUGS-38423: Distinguish NotExist from nil for keepalived sentinel file errors. #329
OCPBUGS-38562: Handle errors in iptables healthcheck #330
OCPBUGS-32348: Change mechanism of debug flag #309
OCPBUGS-32141: Fix handling of ELB Node IP detection #316
OCPBUGS-34706: Add support for OVN HostCidrs annotation #317
OCPBUGS-34136: Updating ose-baremetal-runtimecfg-container image to be consistent with ART for 4.17 #314
OCPBUGS-32141: Handle scenario when VIP does not belong to L2 #313
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-102061, OCPBUGS-103161: Use patched x/net fork v0.35.0-sec.4 #2417
OCPBUGS-91064, OCPBUGS-94526: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2345
OCPBUGS-111835: Fix pre-existing unit test failures #2373
OCPBUGS-64615: Help with must-gather scheduling through suggesting preferance of nodes #2150
OCPBUGS-56734: Adding sos.conf file for default sos config into the tools image #2027
OCPBUGS-58091: avoid transfering permissions when copying artifacts from node-joiner pod #2053
OCPBUGS-57446: Use fedora image in unit tests instead of centos #2038
OCPBUGS-49607: Address golang.org/x/* CVEs #1962
OCPBUGS-50984: Add HOST env var in oc debug for sos report collects more #1976
OCPBUGS-49605: Address github.com/docker/docker CVE #1968
OCPBUGS-45344: additional rbac policy rules #1937
OCPBUGS-45517: add retry in case of image pull error #1940
OCPBUGS-44508: Show node-joiner container logs when error occurs #1912
OCPBUGS-44830: Fix newapp unit test failure by using different image #1913
OCPBUGS-43696: Bump k8s dependencies to 1.30.5 #1902
OCPBUGS-41642: vendor: Update openshift/api to pick up the v4.17 capability set #1876
OCPBUGS-42176: Fix copy artifacts for all CPU architectures #1880
OCPBUGS-42721: Update push targets of digest with new appended tags #1892
OCPBUGS-42580: fix outputname flag for node-image create command #1888
OCPBUGS-42164: Check cast result in adm prune deployments to prevent panic #1879
OCPBUGS-39090: use proxy settings when required #1860
make the idle command’s scale update unconditional #1856
OCPBUGS-38720: Add examples for some oc adm policy commands #1850
WRKLDS-1318: flags for single node interface #1841
OTA-1309: upgrade-status: test a compact cluster and a single-node cluster #1829
WRKLDS-1429: Adds a guardrail for node-image commands which is supported only for Openshift version 4.17+ #1837
OTA-1153: upgrade-status: communicate control plane completion clearly #1831
NO-JIRA: upgrade-status: fix HasOSImage function #1834
WRKLDS-1316: Retry and do not fail when logs cannot be updated #1836
NO-JIRA: upgrade-status: fix a typo in README #1830
WRKLDS-1316: Remove clusterversions from certificates api group #1835
AGENT-854: add the required role to support platform type validation #1832
WRKLDS-1316: oc adm node-image monitor command #1823
OTA-1291: upgrade status: removes custom nodes from the worker pool (2) #1825
NO-JIRA: Minor wording tweaks for CLI help #1826
OCPBUGS-37345: Revert “OCPBUGS-35994: pkg/cli/admin/upgrade/rollback: Drop this command” #1827
OTA-1291: upgrade status: removes custom nodes from the worker pool #1822
: MULTIARCH-4568: Inject ReleaseArch into openshift-install #1792
OCPBUGS-35994: pkg/cli/admin/upgrade/rollback: Drop this command #1806
no-jira: Extend the kube version check for images/tools/Dockerfile #1813
OCPBUGS-36525: Bump k8s to 1.30.2 #1812
WRKLDS-1310: pkg/cli/admin/mustgather: GA since and since-time flags #1811
OCPBUGS-36183: pkg/cli/admin/prune/renderedmachineconfigs: ‘Error dry-run deleting’ #1807
OCPBUGS-33897: upgrade status: control plane completion estimate #1742
OCPBUGS-31848: don’t manually delete must-gather’s cluster role binding #1790
OCPBUGS-34877: Ignore pruning when deployment points to replicationcontroller #1797
NO-JIRA: pkg/helpers: remove legacy pkg #1791
WRKLDS-1292: oc k8s 1.30 bump #1789
NO-JIRA: Update comment about using OpenFileSequential #1793
OCPBUGS-33896: upgrade status: polish alert insights #1787
OCPBUGS-32108: stop loading legacy schemes on global scheme #1775
OCPBUGS-33896: status/inspect-alerts: handle non-200 by Thanos #1782
OCPBUGS-34465: Updating openshift-enterprise-deployer-container image to be consistent with ART for 4.17 #1785
OCPBUGS-33903: Simplify output when not updating #1774
OCPBUGS-34207: Updating ose-tools-container image to be consistent with ART for 4.17 #1780
OCPBUGS-34154: Updating openshift-enterprise-cli-container image to be consistent with ART for 4.17 #1779
OCPBUGS-33762: Hardcode resource groups/kinds for now #1773
AUTH-482: set required-scc annotation to privileged for node debug pods #1763
OCPBUGS-33905: pkg/cli/admin/upgrade/rollback: Gate on OC_ENABLE_CMD_UPGRADE_ROLLBACK #1764
OCPBUGS-33651: Add s390x based oc into extraction target #1766
OCPBUGS-33896: add alert data to upgrade health in oc adm upgrade status #1740
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

cloud-credential-operator

OCPBUGS-103157: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #1101
OCPBUGS-81861: Bump go-jose/go-jose/v4@v4.1.4 #1039
OCPBUGS-80044: Bump google.golang.org/grpc to v1.79.3 #1025
OCPBUGS-65801: ccoctl azure: retry custom role creation on consistency errors #951
OCPBUGS-65480: ccoctl: use pagination when listing resources in aws #945
OCPBUGS-63549: ccoctl: add public-key-file flag to create-all #939
OCPBUGS-55128: snyk to ignore SNYK-GOLANG-GOLANGORGXNETHTML-9572088 #917
OCPBUGS-60972: ccoctl: aws to use proper issuer url on subsequent runs #908
OCPBUGS-58679: github.com/golang/glog v1.2.5 #892
OCPBUGS-58248: ccoctl: only add owned tag to azure resources on create #883
OCPBUGS-56980: Azure: resolve nil pointer exception when role assignment exists #868
OCPBUGS-54828: Render: configure proxy on bootstrap static pod #863
OCPBUGS-53415: github.com/golang/glog v1.2.4 #842
OCPBUGS-53823: update github.com/golang-jwt/jwt #838
OCPBUGS-51548: Ignore SNYK-GOLANG-GOLANGORGXOAUTH2JWS-8749594 due to not being affected #828
OCPBUGS-51238: github.com/go-jose/go-jose/v4 v4.0.5 #825
OCPBUGS-47071: golang.org/x/net v0.33.0 #804
OCPBUGS-45938: Add AWS region to aws-pod-identity-webhook #799
OCPBUGS-45006: Add retry to ccoctl gcp create functions #793
OCPBUGS-45001: github.com/golang-jwt/jwt/v4 v4.5.1 #787
OCPBUGS-44123: Add GCP pod identity webhook #776
OCPBUGS-43644: Only attempt timed token credentials on supported platforms. #773
OCPBUGS-43335: Update github.com/sirupsen/logrus v1.9.3 #766
OCPBUGS-41233: List secrets in batches to avoid api timeout #756
OCPBUGS-38952: Follow-up bug fixes for CCO-572 #751
OCPBUGS-38375: update google.golang.org/grpc v1.65.0 #747
SPLAT-1718: Remove alibaba #737
CCO-572: STS OLM for GCP (WIF) #708
CCO-580: Upgrade to Kubernetes 1.30 #725
OCPBUGS-37334: SNYK ignore go-client misreporting #734
OCPBUGS-35016: Update to azidentity v1.7.0 #716
OCPBUGS-34347: Updating ose-cloud-credential-operator-container image to be consistent with ART for 4.17 #719
OCPBUGS-36032: IBM/go-sdk-core update to v5.6.3 #715
OCPBUGS-36140: GCP passthrough permissions check to ignore problematic permissions. #712
NO-JIRA: Fix Makefile for developer install #711
OCPBUGS-33566: AWS STS should not error when a credentailsRequest does not have awsSTSIAMRoleARN #703
OCPBUGS-33621: docs: Azure WI migration to extract only the credentialRequests needed by the cluster. #702
Full changelog

cloud-network-config-controller

OCPBUGS-66132: [release-4.17] Fix capacity calculation #194
OCPBUGS-65520: Change the capacity struct from int to ptrOfInt #191
OCPBUGS-56257: Increase API call timeout to 30 second #171
SDN-4773: Add support for Azure Managed Service Identity authentication #151
NO-JIRA:Update linter file #146
SDN-4924: Rebase 1.30 #150
OCPBUGS-34302: Updating ose-cloud-network-config-controller-container image to be consistent with ART for 4.17 #148
Full changelog

cluster-authentication-operator

OCPBUGS-103168: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #989
OCPBUGS-68150: Update library-go to fix CVE-2025-65637 #840
OCPBUGS-54580: Avoid duplicate OAuth client creation #765
OCPBUGS-43657: audit: do not log requests to /livez #724
OCPBUGS-42784: manifests should not use APIs that are removed in upcoming releases #712
OCPBUGS-42545: when no type is specified, don’t make illegal condition #703
OCPBUGS-39021: increase oauth-apiserver failureThreshold #693
OCPBUGS-35828: controller: set ownership annotation for webhook-auth secret #678
NO-JIRA: endpoint test: use httpbin #680
NO-JIRA: Several fixes for Keycloack IDP test #679
NO-JIRA: OWNERS: add ibihim, liouk, rm old #677
OCPBUGS-33654: update OpenShift favicon to new brand standard #674
OCPBUGS-33654: update OpenShift favicon to new brand standard #670
Full changelog

cluster-autoscaler

OCPBUGS-78700: allow clusterapi provider to skip paused resources #414
OCPBUGS-68151: update logrus to version 1.9.3 #398
OCPBUGS-60913: revert openshift replica fix #376
OCPBUGS-60608: fix checkpoint gc of unknown recommenders #371
OCPBUGS-59266: Fix cool down status condition to trigger scale down #362
OCPBUGS-54325: improve replica counting and decrease target size behavior #352
OCPBUGS-48606: UPSTREAM: <carry>: 🐛(metrics) Initialize metrics for autoscaler errors, scale events, and pod evictions #337
OCPBUGS-45147: [release-4.17] VPA: Update OWNERS file #324
OCPBUGS-37498: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.17 #311
PODAUTO-202: Update VPA ocp/builder Dockerfile images to openshift/release images #310
PODAUTO-199: Upstream rebase to VPA 1.1.2 #309
OCPBUGS-34242: Updating ose-vertical-pod-autoscaler-container image to be consistent with ART for 4.17 #304
NO-JIRA: Update OWNERS #307
OCPCLOUD-2616: rebase on upstream 1.30.1 release #306
OCPBUGS-34428: Updating atomic-openshift-cluster-autoscaler-container image to be consistent with ART for 4.17 #305
OCPBUGS-33904: Updating atomic-openshift-cluster-autoscaler-container image to be consistent with ART for 4.17 #302
OCPBUGS-33592: fix: scale up broken for providers not implementing NodeGroup.GetOptions() #300
Full changelog

cluster-autoscaler-operator

OCPBUGS-103166: Bump x/net package in release-4.17 #389
OCPBUGS-45929: set max soft bulk taint count to zero #337
NO-JIRA: Update OWNERS #329
OCPBUGS-35952: add aws zone-id to ignore labels #328
OCPCLOUD-2617: Bump k8s to 1.30 #327
OCPBUGS-34151: Updating ose-cluster-autoscaler-operator-container image to be consistent with ART for 4.17 #323
Full changelog

cluster-baremetal-operator

OCPBUGS-103170: Use patched x/net fork v0.35.0-sec.4 #672
OCPBUGS-77446: Bump github.com/go-errors/errors to v1.5.1 #561
OCPBUGS-63715: Always have a service for ironic-api port #519
OCPBUGS-63666: Allow provisioningIP when network disabled #518
OCPBUGS-61097: Remove webhookport (9447) as HostPort #505
OCPBUGS-54542: Add missing relatedObjects #469
OCPBUGS-41926: SCC-pinning for metal3-baremetal-operator #444
OCPBUGS-29660: Ignore provisioning ip config if disabled #429
METAL-1040: Allow CBO to run without MAPI #423
METAL-503: Remove ironic-inspector #430
OCPBUGS-29687: Move Secrets from environment variables to VolumeMounts in metal3-httpd container #408
AUTH-482: set required-scc for openshift workloads #407
OCPBUGS-29687: Move pull secret from env var to VolumeMount in metal3-image-customization container #428
OCPBUGS-35211: Add capability to metal3-ramdisk-logs container #424
OCPBUGS-34649: provisioning: add ownership for tls secret #422
OCPBUGS-34119: Upgrade controller-tools and library-go #421
OCPBUGS-34119: Updating ose-cluster-baremetal-operator-container image to be consistent with ART for 4.17 #419
OCPBUGS-32304: Run metal3 containers as specific users and groups #417
Full changelog

cluster-bootstrap

OCPBUGS-34034: Updating ose-cluster-bootstrap-container image to be consistent with ART for 4.17 #108
Full changelog

cluster-capi-controllers

OCPBUGS-80045: Bump google.golang.org/grpc to v1.79.3 #291
NO-JIRA: Update OWNERS #211
OCPCLOUD-2625: Merge https://github.com/kubernetes-sigs/cluster-api:v1.7.2 (a5898a2) into master #210
OCPBUGS-34133: Updating ose-cluster-api-container image to be consistent with ART for 4.17 #208
Full changelog

cluster-capi-operator

OCPBUGS-80049: Bump google.golang.org/grpc to v1.79.3 #570
NO-JIRA: Allow sustaining engineering to self serve dependency updates #559
append .0 to go.mod version #314
OCPBUGS-48493: fix: always update clusteroperator status versions when differing #250
OCPBUGS-41576: Use CAPO v0.10 and API v1beta1 #205
OCPBUGS-39309: manifests-gen: fix: readd missing metadata #198
OCPBUGS-37718: fix: align openstack e2e branch #191
OCPBUGS-36296: fix: sort CredentialsRequest manifests after namespace #183
OCPCLOUD-2638: Add stricter linting configuration #186
OCPCLOUD-2204, OCPCLOUD-2205, OCPCLOUD-2206, OCPCLOUD-2207: Add InfraCluster controller + AWSCluster implementation #169
OCPCLOUD-2584: Implement compression of components in configMap #170
NO-JIRA: Update OWNERS #179
OCPCLOUD-2619: Bump CAPI 1.7 and k8s 1.29 #176
OCPBUGS-34085: Updating ose-cluster-capi-operator-container image to be consistent with ART for 4.17 #174
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-103176: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #514
OCPBUGS-63167: ccm: disable unused secure-serving port and webhook #423
OCPBUGS-60211: Update service selector to match deployment label #406
OCPBUGS-60211: Add Service using common resource templating #407
OCPBUGS-43389: update goimports targets #371
OCPBUGS-41941: IBMCloud: Modify liveness probe for IBM Cloud CCM to use loopback address #365
SPLAT-1720: Remove Alibaba #324
OCPBUGS-35798: PowerVS: Remove bind address #355
NO-JIRA: Update OWNERS #357
OCPCLOUD-2609: rebase for kubernetes 1.30 #356
NO-JIRA: openstack: Remove dulek from OWNERS #345
OCPBUGS-34144: Updating ose-cluster-cloud-controller-manager-operator-container image to be consistent with ART for 4.17 #346
OCPBUGS-34938: Refactor resourceapply tests #352
OCPBUGS-34689: Nutanix CCM pods Cipher Suites vulnerability issue #348
Full changelog

cluster-config-api

CNTRLPLANE-1981: Promote streaming list encoding to Default #2599
OCPBUGS-71184: Add HTTPKeepAliveTimeout to IngressController API #2639
NO-JIRA: Promote streaming list encoding to Default on Hypershift. #2567
CNTRLPLANE-1611: Add feature gates for StreamingCollectionEncoding #2538
OCPBUGS-57285: Add IPsec API for NAT-T UDP encapsulation support #2363
OCPBUGS-49702: Add IdleConnectionTerminationPolicy field to IngressControllerSpec #2186
OCPBUGS-39130: Added checks to prevent vCenters from changing after install past 1 vCenter #2014
OCPBUGS-41642: config/v1/types_cluster_version: Add v4.17 capability set #2023
OCPBUGS-34333: Updating ose-cluster-config-api-container image to be consistent with ART for 4.17 #1903
features: disable PSA #2018
OCPBUGS-38355: Promote AWSEFSDriverVolumeMetrics to GA #2020
OCPBUGS-39300: clean up openshift-sdn references in the API [4.17] #2008
OCPBUGS-38958: [4.17] add UserNamespacesSupport/ProcMountType to tech preview features #2011
OCPBUGS-38605: remove duplicate featuregate ‘ExternalRouteCertificate’ #2004
CFE-921: Enable GCPLabelsTags featureGate by default for GA #1971
MULTIARCH-4776: MULTIARCH-4770: installer: promote MultiArchInstall FGs #1991
Power VS: Move Power VS to CAPI by default #1979
CORS-3617: Promote Azure CAPI as the default Install method #1987
STOR-1422: Add field for enabling EFS volume metrics #1853
SDN-5086: Add API and feature gates for OVN-K BGP support #1944
NE-1794: Promote eipAllocations API in GA #1989
SDN-5186: Add OVNObservability feature gate as Tech Preview. #1986
AUTH-527: security/v1 - add constant for enforcing psa annotation #1980
IR-471: Removing featuregate for chunkSizeMiB config #1948
Run update-payload-crds after update-codegen-crds #1974
CORS-3594: Setting CAPG as the default infra provider #1958
NE-1774: Promote IngressControllerLBSubnetsAWS to GA #1966
OCPBUGS-35906: a rule to check if the featureSet is one of the known set of features #1952
featuregate promotion: use latest release instead of hard coding #1984
Add MCP and Config Version columns to MCN output #1972
MCO-1065: MCO-1171: Promoting ManagedBootImages and NodeDisruptionPolicy to default featureset #1975
MULTIARCH-4770: features: move MultiArchInstall[AWS|GCP] to TechPreview #1973
Nutanix mapi: gpus and dataDisks support #1935
CONSOLE-4161: Add support for lightspeed button integration #1956
NE-1516: Add configuration for AWS Elastic IPs (EIPs) via Ingress Controller CR. #1826
Added Feature Gate for Bootc Update Path #1969
CORS-3607: Add Azure CAPI installer to tech preview feature set #1967
OCPNODE-2436: SigstoreImageVerification featuregate marker for the ClusterImagePolicy and ImagePolicy #1964
Feature gate sippy queries to use variant registry #1909
NE-1530: Fix empty subnet list CEL validation #1961
OCPBUGS-36523: Rename Dockerfile #1949
NE-1530: IngressController LB Subnet Selection in AWS #1841
MCO-1215: add ManagedBootImagesAWS to Feature Gate #1945
OCPBUGS-36469: Update placementGroupPartition to pointer #1953
OCPNODE-2358: Update (cluster)imagepolicy doc no restriction on release repo scopes #1927
OCPBUGS-36213: Remove the conversion webhook reference from the ConsolePlugin CRD spec #1946
features: add multi-arch feature gate per platform #1947
MON-3546: Add ClusterMonitoringCRD feature gate #1930
SDN-4934: Add NetworkSegmentation Feature Gate #1941
OCPBUGS-34906: Fix IngressController missing listTypes #1917
METAL-1038 Remove baremetal dependency on MachineAPI capability #1916
NO-JIRA: remove beta enabled features from feature gates #1934
OCPBUGS-34907: prevent removing featureSet entirely #1932
CFE-1063: Add PlacementGroupPartition in AWSMachineProviderConfig #1897
Update published Kubebuilder tools #1924
OCPBUGS-34974: IBMCloud: Add IBM Cloud Services #1919
CNV-41151: ipam, virt: add persistent ips feature gate #1913
Adds conditions to MachineSet #1907
Feature gates for platforms, architecture, and installs #1895
API-1783: Bump 1.30.1 #1906
OCPBUGS-33787: add console and download URLs to console operator config #1887
OCPCLOUD-2563: Add Machine/MachineSet API for MAPI to CAPI migration #1818
OCPBUGS-33882: Streamline bootstrap crds #1899
STOR-1839: promote VSphereDriverConfiguration feature to Accessible-by-default #1902
API-1783: bump(k8s): update k8s to v1.30 #1813
CFE-1047: Add the field “CapacityReservationGroupID” to “AzureMachineProviderSpec” in openshift/api #1866
remove console v1alpha1 which was present since 4.12 #1856
ETCD-488: Move etcd hardware speed feature to GA #1844
API-1783: Promote ValidatingAdmissionPolicy to GA #1888
NO-JIRA: Enable the ibm-cloud-managed cluster profile on network.operator CRD #1896
Full changelog

cluster-config-operator

OCPBUGS-75998: Update logrus to 1.9.3 to address CVE-2025-65637 #465
append .0 to go.mod version #441
OCPBUGS-34178: Updating ose-cluster-config-operator-container image to be consistent with ART for 4.17 #419
Full changelog

cluster-control-plane-machine-set-operator

OCPBUGS-44047: relax validation on delete and if failureDomains not configured #330
OCPBUGS-38643: Add 1 minute stabilisation for clusteroperators after rollout #321
OCPBUGS-36469: Bump openshift/api #315
CFE-1087: API Bump for capacity Reservation #313
NO-JIRA: Update OWNERS #311
NO-JIRA: CPMS Cluster Operator should set related objects #310
OCPBUGS-35416: Wait for ControlPlaneMachineSet to be created when waiting for it to be updated #305
OCPBUGS-35069: Improved debugging of API listing errors #297
OCPBUGS-20061: Add unreadyNodeGracePeriod for allowing brief node hiccups #294
OCPCLOUD-2600: Bump deps to k8s v1.30, go 1.22 #295
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-103180: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #292
CNV-43972: HCP custom tolerations integration #214
STOR-1593: Update api extensions to upstream #215
STOR-1596: Bump all deps for 4.17 #213
OCPBUGS-36528: Rename Dockerfile #212
OCPBUGS-34449: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 4.17 #210
OCPBUGS-34174: Updating ose-cluster-csi-snapshot-controller-operator-container image to be consistent with ART for 4.17 #209
Full changelog

cluster-dns-operator

OCPBUGS-103178: Use patched x/net fork v0.35.0-sec.4 #494
OCPBUGS-52497: [release-4.17] Add runbook_url for CoreDNSErrorsHigh #430
OCPBUGS-33750: Bump version of DNSNameResolver controller #415
OCPBUGS-34229: Updating ose-cluster-dns-operator-container image to be consistent with ART for 4.17 #414
OCPBUGS-34229: Updating ose-cluster-dns-operator-container image to be consistent with ART for 4.17 #413
Full changelog

cluster-etcd-operator

OCPBUGS-103181: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #1696
OCPBUGS-68156: Update logrus to 1.9.3 to address CVE-2025-65637 #1542
OCPBUGS-61337: Vendor latest mixin, including additional and modified alerts for etcdDatabaseQuotaLowSpace #1480
OCPBUGS-60220: add missing ports to svc and pod spec #1461
OCPBUGS-53511: fix CVE-2025-30204 #1414
OCPBUGS-38574: use pooled client for etcd single member health checks #1327
OCPBUGS-38454: prefer env var over hardcoding ciphers #1316
NO-JIRA: degrade targetconfigcontroller on quorum loss #1309
OCPBUGS-36462: ensure ordering in member health checks #1308
NO-JIRA: only update envvar listeners on real changes #1300
ETCD-636: expose PruneOpts #1297
ETCD-493: Reflect etcd grafana dashboard mixin from upstream #1291
ETCD-604: Prune revisioned resources #1292
OCPBUGS-36621: Force sync on missing etcd-all-bundles configmap #1296
Revert “OCPBUGS-36621: add etcd-all-bundles to cvo create-only” #1295
ETCD-574: Update TLS artifact descriptions according to registry requ… #1294
OCPBUGS-36621: add etcd-all-bundles to cvo create-only #1293
NO-JIRA: only read signer/bundles on forced leaf generation #1288
OCPBUGS-36301: parallelize member health checks #1286
OCPBUGS-36407: Rename Dockerfile.rhel7 to Dockerfile.ocp #1289
NO-JIRA: cert rotation same assertions #1285
NO-JIRA: fix false positive bootstrap in cert signer controller #1283
NO-JIRA: update library-go #1281
ETCD-607: gate leaf cert generation (with bundle revision) #1275
NO-JIRA: Update etcd-tls-assets.md #1195
ETCD-606: Batch bundle revision rollout #1271
NO-JIRA: update library go #1274
ETCD-620: Update api vendor libraries to get GA’ed tuning profiles #1264
TRT-1687: Revert #1268 “ETCD-606: Batch bundle revision rollout” #1270
ETCD-603: add revision helpers #1267
OCPBUGS-34376: Updating cluster-etcd-operator-container image to be consistent with ART for 4.17 #1263
NO-JIRA:check the cluster is healthy or not after getting env var, to ensure it is safe to rollout #1262
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-image-registry-operator

OCPBUGS-68157: Bump github.com/sirupsen/logrus to 1.9.3 #1284
OCPBUGS-53871: bump github.com/golang-jwt/jwt #1218
OCPBUGS-51604: bump golang.org/x/oauth2 #1209
OCPBUGS-51103: ensure that storage names don’t end in dashes #1180
OCPBUGS-43564: fix proxy config and leader election test flakes #1144
OCPBUGS-43350: pkg/storage/azure: also check for auth failure error code on deletion #1139
OCPBUGS-42812: azureclient: stop validating credentials when creating the client #1130
OCPBUGS-42394: pkg/storage/azure: use cluster-api tag key to discover vnet #1125
OCPBUGS-42362: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #1124
OCPBUGS-38538: Avoid Shared Access Key usage for Azure Storage Account when using Managed Identity based auth #1103
OCPBUGS-38885: pkg/resource: invoke update-ca-trust extract with –output #1097
IR-467, OCPBUGS-38379: Enable MSI override for ARO HCP #1088
SPLAT-1721: Remove alibaba #1077
IR-471: Removing featuregate for chunkSizeMiB config #1073
Revert “IR-467: Enable Azure MSI authentication” #1079
IR-467: Enable Azure MSI authentication #1020
OCPBUGS-37207: Power VS: Check endpoints against lower case strings #1076
IR-471: Adding additional validation #1074
OCPBUGS-36038: go.*,vendor: bump go-retryablehttp #1063
IR-477: pkg/operator: deactivate azure path fix job #1061
IR-471: Exposing chunksize variable to utilize docker registry config #1060
OCPBUGS-34107: Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.17 #1045
OCPBUGS-34399: Update rbac for featuregate #1056
OCPBUGS-33453: add SAR capability to image-registry #1046
CFE-962: Refactor code to mock GCP tag service for UTs #1027
OCPBUGS-34399: Revert “Merge pull request #1026 from deepsm007/expose-chunksize” #1052
OCPBUGS-34399: Exposing chunksize variable to utilize docker registry config #1026
OCPBUGS-34107: Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 4.17 #1040
OCPBUGS-32710: pkg/storage/s3: use force path style in favour of virtual hosted style config #1028
OCPBUGS-33149: azure-path-fix: get client secret from k8s secret #1029
OCPBUGS-33868: Bump openshift api, client-go & library-go #1036
Full changelog

cluster-ingress-operator

OCPBUGS-103182: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1572
OCPBUGS-86714: Add configuration override for X-SSL strip #1486
OCPBUGS-71184: Implement HTTPKeepAliveTimeout tuning option #1335
OCPBUGS-49702: Add e2e tests for IdleConnectionTerminationPolicy #1225
OCPBUGS-49702: Add support for IdleConnectionTerminationPolicy #1223
OCPBUGS-39220: Ingress operator status not degraded when canary route fails #1136
OCPBUGS-38646: Clear LB Status Parameters on LB Type Change #1131
OCPBUGS-38540: Resolve DNS Resolution CI Flakes in Subnets and EIP E2E #1129
OCPBUGS-38079: Bump controller-runtime to v0.18.4 #1122
NE-1798: API bump for promotion of eipAllocation from feature gates to GA. #1118
NE-1688: Enable Azure MSI authentication for ARO HCP #1119
NE-1674: Add LB EIP Allocation for AWS #1109
NE-1531: Fix Initialization of NLB Status Parameters #1114
NE-1531: AWS Subnet Selection #1046
NE-1273: Add a watch to the ingress operator so it will recreate the gwapi crds #1106
OCPBUGS-37627: Fix getRouteHost error handling #1110
NE-1208: Gateway API E2E Testing #1023
OCPBUGS-31664: Fix SyncLoadBalancerFailed status message of IngressController #1102
OCPBUGS-36465: Delete and recreate canary route to clear spec.host #1095
OCPBUGS-34413: Refine logging for accurate infra CR status updates #1103
OCPBUGS-35342: Add e2e test for connect timeout #1084
NO-JIRA: Add grzpiotrowski to OWNERS #1090
NO-JIRA: addowner-Thealisyed #1091
OCPBUGS-35356: Retry IngressController updates in router status E2E #1085
OCPBUGS-9037: Change Canary to use passthrough route #978
OCPBUGS-35368: Add Regexp Anchor to TestAll #1087
OCPBUGS-23221: internalServiceChanged: Fix target port logic #1052
OCPBUGS-34262: Updating ose-cluster-ingress-operator-container image to be consistent with ART for 4.17 #1067
NE-1400: Bump to OSSM 2.5 and Gateway API v0.6.2 CRDs #1018
OCPBUGS-33792: Bump openshift/library-go to resolve NewPrometheusClient E2E failures #1054
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-103173: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #2300
OCPBUGS-68162: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #2055
OCPBUGS-63614: SCC: add hostmount-anyuid-v2 #1954
OCPBUGS-60398: Add missing service ports to apiserver service #1893
OCPBUGS-50516: Increase waitForFallbackDegradedConditionTimeout #1803
OCPBUGS-43657: audit: do not log requests to /livez #1758
OCPBUGS-34310: Updating ose-cluster-kube-apiserver-operator-container image to be consistent with ART for 4.17 #1738
OCPBUGS-41874: increase kube-apiserver failureThreshold #1733
OCPBUGS-34679: revert dev cert rotation 4.17 #1729
OCPBUGS-34942: Update APIRemovedInNextReleaseInUse for kube 1.30 / ocp 4.17 #1698
NO-JIRA: nodekubeconfigcontroller: set ownership component for node kubeconfigs #1704
AUTH-521: add disabled syncer as reason to CFE for PSA #1686
NO-JIRA: update library-go #1703
OCPEDGE-1102: Revert high cpu usage alert description #1680
OCPEDGE-902: add SNO control plane high cpu usage alert #1676
OCPBUGS-34782: manifests: add ownership annotation for kubelet-bootstrap-kubeconfig #1694
OCPBUGS-34544: Disable PersistentVolumeLabel admission plugin #1693
OCPBUGS-34800: Update APIRemovedInNextReleaseInUse for kube 1.30 / ocp 4.17 #1697
OCPBUGS-33963: Create one-shot migrations for the flowcontrol group. #1689
API-1783: bump(k8s): update k8s version to v1.30.0 #1666
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-80056: Bump google.golang.org/grpc to v1.79.3 #78
OCPBUGS-42612: Sync Release 4.17 with UPSTREAM #48
UPSTREAM: <carry>: OCPBUGS-30487: Bump google.golang.org/protobuf #39
NO-JIRA: Update OWNERS #40
OCPBUGS-34084: Updating ose-cluster-kube-cluster-api-operator-container image to be consistent with ART for 4.17 #38
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-103172: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #962
OCPBUGS-68164: CVE-2025-65637 openshift4/ose-cluster-kube-controller-manager-rhel9-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.17] #908
OCPBUGS-60249: Missing endpoint slices for open ports the operator uses #855
NO-JIRA: update library-go #814
OCPBUGS-34859: manifests: set owning-component for csr-signer-signer #812
OCPBUGS-34281: Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 4.17 #813
API-1783: bump(k8s): bump k8s version to v1.30.0 #803
OCPCLOUD-2513: Remove cloud-provider, cloud-config, and cloud-volume-plugin flags #806
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-103171: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #670
CNTRLPLANE-2843: chore: update OWNERS #623
OCPBUGS-68165: deps: Update library-go and logrus to fix a CVE #613
no-jira: Rename Dockerfile #546
NO-JIRA: update library-go #544
OCPBUGS-34367: Updating ose-cluster-kube-scheduler-operator-container image to be consistent with ART for 4.17 #543
API-1783: bump(k8s): bump k8s version to v1.30.0 #540
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-68167: Bump github.com/sirupsen/logrus to 1.9.1 #140
OCPBUGS-46593: “gracefully” shutdown KSVM pod. #123
NO-JIRA: bump(*) #113
OCPBUGS-34306: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.17 #110
OCPBUGS-34306: Updating ose-cluster-kube-storage-version-migrator-operator-container image to be consistent with ART for 4.17 #109
Full changelog

cluster-machine-approver

OCPBUGS-48155: Fix race condition in CO status controller test #266
OCPBUGS-46429: Filter CSRs by signerName #261
OCPBUGS-45918: Ensure trailing dots on DNS names do not block serving cert auth #256
OCPBUGS-45918: Client internal DNS checks should ignore trailing dot #250
OCPBUGS-43312: Client internal DNS checks should be case insensitive #242
NO-JIRA: Update OWNERS #236
OCPCLOUD-2602: Update dependencies to Kube 1.30 #235
OCPBUGS-34138: Updating ose-cluster-machine-approver-container image to be consistent with ART for 4.17 #232
OCPBUGS-33644: check for machine crd before listing machines #231
Full changelog

cluster-monitoring-operator

OCPBUGS-129160: don’t delete admin-owned Alertmanager secrets on destroy #3143
NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #3110
OCPBUGS-103184: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame- #3075 #3084
OCPBUGS-77275: AlertingRule: fix duplicate PrometheusRules after MD5->SHA-224 naming change #2832
OCPBUGS-64580: Fix KSM deny-list typo #2732
OCPBUGS-63489: Add mcd_local_unsupported_packages metric from MCO to telemetry 4.17 #2725
OCPBUGS-63123: test: remove image registry e2e tests #2715
OCPBUGS-61766: chore(jsonnet): use prometheus_remote_storage_queue_highest_timestamp_seconds in PrometheusRemoteWriteBehind #2672
OCPBUGS-60017: operator: increase wait time till degraded to max 4 times 5m #2634
OCPBUGS-44971: Add new metrics for OpenShift logging telemetry #2526
OCPBUGS-44003: fix(monitoring-plugin): disable emitting nginx version on error pages #2511
OCPBUGS-43690: chore: introduce a config parsing check via a strict unmarshaller for… #2494
OCPBUGS-43788: Add runbook url for TelemeterClientFailures #2507
OCPBUGS-43545: Fix api doc on Thanos Ruler default retention #2501
OCPBUGS-41341: disable user-defined monitoring per object #2458
OCPBUGS-41908: filter alerts sent to Telemeter #2470
OCPBUGS-41580: Configure graceful shutdown for metrics-server (4.17 backport) #2463
OCPBUGS-39029: Backport #2441 for 4.17 #2445
MON-3972: [bot] Synchronize versions of the downstream components #2434
OCPBUGS-17506: Make error messages clearer on poll timeouts #2417
MON-3964: set scrape timestamp tolerance for user workload monitoring #2429
MON-3961: inject proxy env variables in Alertmanager #2424
MON-3949: [bot] Synchronize versions of the downstream components #2419
MON-3900: follow-up: clean up operator logic and some tests now that metrics-server is the default Metrics API backend #2425
OCPBUGS-37686: fix documentation typos #2427
NO-JIRA: fix: fix a small typo #2426
MON-3921: Revert “Revert “Merge pull request #2392 from machine424/f-… #2403
MON-3959: Skip TestTLSSecurityProfileConfiguration as disruptive #2423
MON-3900: Remove prometheus-adapter code #2409
MON-3947: [bot] Synchronize versions of the downstream components #2418
MON-3947: [bot] Synchronize versions of the downstream components #2414
MON-3947: Bump prometheus-operator to 0.75.1 #2416
MON-2065: jsonnet: exclude kubernetes-storage rules #2377
OCPBUGS-36495: Add deprecated config runbook #2410
OCPBUGS-31250: Exclude windows nodes from kubelet servicemonitor #2368
OCPBUGS-36406: add runbook_url annotations #2401
MON-3914: add a regression test for gogc based on the go_gc_gogc_percent metric #2393
MON-3914: [bot] Synchronize versions of the downstream components #2394
OCPBUGS-36299: Revert #2392 “MON-3800: jsonnet: update prometheus dep to fetch the PrometheusKuber…” #2398
MON-3800: jsonnet: update prometheus dep to fetch the PrometheusKuber… #2392
OCPBUGS-35480: Add deprecation for prometheus adapter #2381
MON-3915: chore: bump Go dependencies #2387
MON-3914: adjust Prometheus GOGC based on infra topology #2390
OCPBUGS-32696: opt-out of multi-cluster Prometheus dashboard #2351
OCPBUGS-35397: attach runbook to the PrometheusDuplicateTimestamps alert #2365
MON-3905: [bot] Synchronize versions of the downstream components #2382
MON-3894: revert(monitoring-plugin): undo nginx caching tweaks as the issue was… #2380
MON-3795, SDN-3817: Expose OVNKubernetes:AdminNetworkPolicy Metrics via telemetry #2297
MON-3897: [bot] Synchronize versions of the downstream components #2378
OBSDOCS-883: change docs to correct retention time uwm prometheus #2277
MON-3884: Send metric acm_managed_cluster_worker_cores via Telemetry #2367
MON-3887, MON-3889: [bot] Synchronize versions of the downstream components #2376
MON-3888: bump go tools 1.22 #2375
MON-3882: [bot] Synchronize versions of the downstream components #2371
MON-3701: clean-up injection of CA bundle for user Alertmanager #2361
OCPBUGS-33645: inject trusted CA bundle into UWM Alertmanager #2349
OCPBUGS-34437: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.17 #2372
MON-3881: chore: remove hack/ocp-images.sh #2366
MON-3801: clean-up unused OAuth proxy references #2359
MON-3701: clean-up injection of CA bundle for user Prometheus #2362
MON-3874: chore: poll immediately in the e2e tests #2356
MON-3701: clean-up tests #2360
OCPBUGS-33955: remove deprecated logtostderr argument #2355
OCPBUGS-33686: [bot] Synchronize versions of the downstream components #2363
OCPBUGS-23000: node-exporter: Prevent cluster-autoscaler from evicting #2346
MON-3763: Add cnv_abnormal #2291
OCPBUGS-34080: Updating cluster-monitoring-operator-container image to be consistent with ART for 4.17 #2358
: NO-JIRA: Fix formatting in the resources documentation #2353
Full changelog

cluster-network-operator

OCPBUGS-85244: whereabouts-token-watcher DaemonSet improvements #3016
OCPBUGS-84181: fix(hypershift): use net.JoinHostPort for URL construction #2983
OCPBUGS-73799: Tweak iptables-alerter to try to avoid crictl bug #2878
: NO-JIRA: Update CNO reviewers/approvers #2767
OCPBUGS-74348: [release-4.17] fix typo in release annotation for whereabouts-token-watcher deamonset #2888
OCPBUGS-45086: Re-disable metrics server #2579
OCPBUGS-63154: Add drop flows for GARPs #2818
[Release 4.17] OCPBUGS-61765: Update CNO reviewers/approvers #2799
OCPBUGS-58066: [release-4.17]: Manual feature backport of cert rotation for whereabouts #2784
OCPBUGS-57285: Implement IPsec NAT-Traversal encapsulation option #2726
OCPBUGS-55518: iptables-alerter streamlining #2698
OCPBUGS-55033: Add IPv6 NGINX configuration #2689
OCPBUGS-52951: Unexpected Behavior During Cluster Upgrade for the ovn-ipsec-host pods #2654
OCPBUGS-49816: ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs #2655
OCPBUGS-49961: Update egressfirewall CRD to be consistent with ovn-kubernetes repo #2642
: OCPBUGS-44863: Add nodeslicepool #2574
OCPBUGS-44807: ovn-k, cudn: Add missing permissions to ovnkube-node #2575
OCPBUGS-43714: Skip including default crypto policies to avoid authby issue #2597
OCPBUGS-46146: Remove ip xfrm state when IPsec is disabled #2594
OCPBUGS-44415: Pass transit_switch_subnet options in ovnkube-node pod #2561
OCPBUGS-44807, SDN-4930, SDN-5297: OVN-Kubernetes node RBAC tightening #2568
OCPBUGS-44807, SDN-5297, SDN-5472: bindata, ovn-k: Add ClusterUserDefinedNetwork CRD and RBAC #2566
OCPBUGS-44807, SDN-4930, SDN-5297: ovn-k, udn: Update UserDefinedNetwork CRD #2551
OCPBUGS-44807, SDN-4930, SDN-5297: Adds UDN list/watch to ovnknode rbac #2540
OCPBUGS-44779, SDN-5436: Provide support for user owned IPsec machine configs #2564
OCPBUGS-44330: Add controlplane cli image envar for use with hypershift #2542
OCPBUGS-43343: OCPBUGS-42244: Exporting environment varialbe NODE_CNI for live migration #2536
OCPBUGS-43317: Use CNIConfDir for mounting directory to ovn-ipsec-host pod #2533
OCPBUGS-39300: rebase openshift/api for openshift-sdn removal [4.17] #2477
OCPBUGS-39121: Live migration: report network overlap via live_migration_blocked metric #2483
OCPBUGS-42260: Configure narrowing=yes for IPsec connections #2510
OCPBUGS-41674: Add configurable subnets while running hybrid-overlay-node binary #2497
OCPBUGS-41591: Set required-scc for openshift workloads #2490
OCPBUGS-39313: HyperShift: do not use antiaffinity on single replica control planes #2486
OCPBUGS-39387: add required-scc annotation to console-plugin deployment #2487
OCPBUGS-39425: Preload networking plugin locales #2489
OCPBUGS-38932: Deploy networking-console-plugin by CNO #2478
OCPBUGS-38932: Add networking-console-plugin image to release payload #2474
OCPBUGS-38654: [release-4.17] Verify that the codegen changes were commited #2475
OCPBUGS-38364: OVN-K, UDN CRD: Add missing permissions to control-plane #2472
OCPBUGS-38176: multus, Add openshift-cnv to globalNamespace #2466
SDN-4919: Change the masquerade subnet default value for new clusters #2460
SDN-5072: Deploy FRR-K8s #2450
SDN-5144: Add UserDefinedNetwork CRD and RBAC #2464
SDN-4773: Add Azure MSI Env Var for ARO HCP #2465
NO-JIRA: more openshift-sdn cleanup #2455
SDN-5070: Allow day 2 customization of masquerade subnet #2421
OCPBUGS-37786: Add proxy env vars to onvkube-node #2453
OCPBUGS-37713: Handle random crictl errors in iptables-alerter #2451
CNV-43973: HCP custom tolerations integration #2441
SDN-4919: OVN-Kubernetes UDN: EndpointSlice mirror controller RBAC permissions #2448
SDN-4934: Enable TechPreview FeatureGate for NetworkSegmentation #2433
OCPBUGS-33758: Fix IC distributed control plane alerts #2406
SDN-5029: ipam, virt: enable the persistent ips feature #2431
SDN-4916: Bump to k8s v1.30 latest #2429
OCPBUGS-30950: Set mount propagation to HostToContainer for /var/lib/kubelet #2368
SDN-4934: Network Segmentation Feature Gate Vendoring from API #2428
OCPBUGS-23758: Set global IP forwarding sysctl parameters while starting ovnkube-node #2385
OCPBUGS-29648: update whereabouts crd #2414
OCPBUGS-31878: Propogate hypershift control plane priority class override to multus and preserve container resource requests #2335
OCPBUGS-35316: Create the configmap mtu if not found #2410
OCPBUGS-34313: Updating cluster-network-operator-container image to be consistent with ART for 4.17 #2381
OCPBUGS-30948: Use applyconfigurations for updating network.oprerator status #2333
SDN-5029: linter: removed deprecated linters #2408
OCPBUGS-23000: Adds cluster-autoscaler annotation to prevent eviction #2369
OCPBUGS-33497: Limit iptables-alerter’s cpu #2401
SDN-4896: Drop openshift-sdn support #2384
NP-976, OCPBUGS-34658: Live migration: add metrics to observe CNI live migration #2388
OCPBUGS-34858, OCPBUGS-34916: Validate live migration before setting the progressing condition #2399
OCPBUGS-34524: Fix DNSResolver feature gate enablement #2387
MON-3795, SDN-3817: Add ANP metric rule expressions for telemetry exposure #2347
OCPBUGS-33497: Handle pod exiting race conditions in iptables-alerter #2377
OCPBUGS-31876: Enable UDP aggregation on s390x #2331
OCPBUGS-34359: Ensure that the node-identity webhook address contains colons for IPv6 #2382
NP-975: Align new node subnet allocation between OVN-K and SDN during live migration #2367
OCPBUGS-32991: Add conditions for ignored-namespaces #2358
NP-974: Validation for live migration from OpenShiftSDN to OVNKubernetes #2344
OCPBUGS-33728: Add custom masquerade subnet against right key at ovnkube-config CM #2371
Full changelog

cluster-node-tuning-operator

OCPBUGS-82706: Bump github.com/moby/spdystream from v0.2.0 to v0.5.1 #1548
OCPBUGS-78214: PPC: filter out namespaces dir #1481
OCPBUGS-63504: Do not cause kubelet failed dependency by ocp-tuned-one-shot.service #1418
And 65 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-olm-operator

OCPBUGS-103193: bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 #246
OCPBUGS-80063: Bump google.golang.org/grpc to v1.79.3 #201
OCPBUGS-37544: add version flag #62
OPRUN-3403: Remove Rukpak references from code #63
OPRUN-3405: Stop building rukpak #60
OPRUN-3437: update configmap permissions #59
OCPBUGS-36686: Re-enable cluster-olm-operator #58
OCPBUGS-34126: Updating ose-cluster-olm-operator-container image to be consistent with ART for 4.17 #55
OCPBUGS-36684: Disable cluster-olm-operator #56
NO-ISSUE: Update owners #57
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-68170: CVE-2025-65637 - Update library-go to bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #653
OCPBUGS-43657: audit: do not log requests to /livez #599
OCPBUGS-41850: increase openshift-apiserver failureThreshold #589
OCPBUGS-34349: Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART for 4.17 #580
OCPBUGS-34349: Updating ose-cluster-openshift-apiserver-operator-container image to be consistent with ART for 4.17 #579
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-47770: Add team members to the OWNERS file #375
no-jira: OWNERS: remove former employees #354
OCPBUGS-35801: nil pointer reference in ocm-operator #355
WRKLDS-1327: Replace wildcards by explicit list of verbs #353
WRKLDS-1292: Bump k8s dependencies to 1.30.1 #352
OCPBUGS-34395: Move cluster Build CR to runlevel 10 to match CRD #351
OCPBUGS-34077: Always Disable Default Rolebindings Controller #346
OCPBUGS-34054: lots of churn during image registry managed/removed transition #347
OCPBUILD-9: Adds capabilities for builder & deployer rolebindings controller #335
Full changelog

cluster-policy-controller

OCPBUGS-103194: Bump golang.org/x/net to v0.35.0-sec.3 #203
OCPBUGS-41849: pkg/psalabelsyncer: switch to PSA version ‘latest’ #154
WRKLDS-1292: bump(k8s.io)=1.30.1 #151
OCPBUGS-34304: Updating ose-cluster-policy-controller-container image to be consistent with ART for 4.17 #150
OCPBUGS-34304: Updating ose-cluster-policy-controller-container image to be consistent with ART for 4.17 #149
Full changelog

cluster-samples-operator

OCPBUGS-129480: Restrict samples operator access to the global pull-secret #733
OCPBUGS-63515: references to github.com/sclorg/django-ex.git now also refer to the branch #658
OCPBUGS-55800: only update LastTransitionTime if operator status change #640
OCPBUGS-55795: Adding filter to clusterOperatorInformerEventHandler #639
OCPBUGS-55894: Samples Operator should sort failing image imports #641
OCPBUGS-55042: Adding mutex to func createSamples on handler.go #632
OCPBUGS-54362: add rhdmalone to owners #619
OCPBUGS-48786: add shannon and aroyoredhat as owners #595
OCPBUGS-39120: Sync the non-OKD assets from master to release-4.17 #577
OKD-225: remove only the EOL CentOS 7 images #575
OCPBUGS-39071: Fix library-sync.sh to handle renames in unsupported samples #565
OCPBUGS-38927: Update Go version, API version and vendored libs to the same versions as in the openshift/api. #564
OCPBUGS-33899: Updating ose-cluster-samples-operator-container image to be consistent with ART for 4.17 #547
OCPBUGS-38471: Only pick up the changes from the supported imagestreams and templates in library-sync.sh. #560
KUBESAW-162: add mfrancisc and metlos as owners #549
Full changelog

cluster-storage-operator

OCPBUGS-103187: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #734
OCPBUGS-87591: remove oVirt code from CSO 4.17 #708
OCPBUGS-41160: Move metrics to vsphere driver #633
OCPBUGS-52222: fix Vsphere cluster Storage operator in Unavailable state #560
OCPBUGS-44997: Fix PodStartupStorageOperationsFailing alert #543
OCPBUGS-43794: add ability to control kube rbac proxy container image on controlplane #529
OCPBUGS-43112: assets: shared-resource: hypershift: add pull-secret to operator SA #520
OCPBUGS-38355: Bump openshift/api to get EFS volume metrics #501
OCPBUGS-38760: include azure perms for route table #503
OCPBUGS-39365: Use restricted-v2 SCC and remove runAsUser in Hypershift #498
STOR-1422: Bump(openshift/api): to get EFS volume metrics #496
CFE-879: Add TagUser role to creadentials request of GCP PD operator #490
OCPBUGS-37488: Pass TOOLS_IMAGE env var to AWS EBS CSI Driver operator #494
CNV-44992: HCP custom tolerations integration #493
OCPBUGS-37633: Add permissions for vsphere_problem_detector to access clustercsidrivers #495
STOR-1767: Disable vsphere-problem-detector alerts if ManagementState==Removed #487
STOR-1596: Bump all deps for 4.17 #486
MON-2065: manifests: add k8s storage rules #477
OCPBUGS-36169: deactivate MultipleDefaultStorageClasses alert immediately after being fixed #483
STOR-1767: add env var OPERATOR_NAME to vsphere csi operator deployment #485
STOR-1593: add patch role to PVs for provisioner #482
OCPBUGS-34590: revert vsphere problem detector controller name change #479
OCPBUGS-34291: Updating ose-cluster-storage-operator-container image to be consistent with ART for 4.17 #476
STOR-1839: VSphereDriverConfiguration feature Accessible-by-default #478
STOR-1839: VSphereDriverConfiguration feature Accessible-by-default #475
OCPBUGS-34291: Updating ose-cluster-storage-operator-container image to be consistent with ART for 4.17 #474
SPLAT-1555: Added featuregate for vSphere Multi vCenter. #465
Full changelog

cluster-update-keys

NO-ISSUE: Updating ose-cluster-update-keys-container image to be consistent with ART for 4.17 #79
Revert “OCPBUGS-38257: Revert #58 “OTA-1304: manifests.rhel/0000_90_openshift-cluster-image-policy: New manifest”” #61
OCPBUGS-37770: Revert #58 “OTA-1304: manifests.rhel/0000_90_openshift-cluster-image-policy: New manifest” #59
OTA-1304: manifests.rhel/0000_90_openshift-cluster-image-policy: New manifest #58
OCPBUGS-35528: keys: Update Red Hat keys to use SHA256 signatures #57
Full changelog

cluster-version-operator

OCPBUGS-103186: Bump golang.org/x/net to v0.35.0-sec.3 #1460
OCPBUGS-58451: Failing=Unknown upon long CO updating #1212
OCPBUGS-50589: Set openshift.io/required-scc: privileged annotation in version pods #1154
OCPBUGS-39558: Filter out shallowly UpdateEffectNone errors from a MultipleErrors message in the Failing condition #1114
OCPBUGS-45328: deps: bump golang.org/x/net to 0.31.0 #1117
OCPBUGS-43586: Upgradeable=False should not block a 4.(y+1).z to 4.(y+1).z’ retarget #1095
OCPBUGS-41642: vendor: Update openshift/api to pick up the v4.17 capability sets #1087
OCPBUGS-37770: cmd/render: Add –feature-gate-manifest-path option #1078
OCPBUGS-37770: pkg/payload/render: Include release image (Cluster)ImagePolicy #1076
OCPBUGS-37345: Revert “OCPBUGS-35994: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream”” #1072
no-jira: TestCVO: set known caps from configv1.KnownClusterVersionCapabilities #1075
no-jira: TestSetCapabilities: use KnownClusterVersionCapabilities for known keys instead of picking DefaultCapabilitySet #1073
OCPBUGS-32678: Fix a panic caused by a data race #1070
OCPBUGS-33983: vendor: Update openshift/api to pick up zz_generated.crd-manifests #1045
OCPBUGS-35994: Revert “OCPBUGS-24535: pkg/payload/precondition/clusterversion/rollback: Allow previous version within z-stream” #1061
Revert “METAL-1053, OCPBUGS-33983: Remove baremetal dependency on MachineAPI capability” #1063
METAL-1053: Remove baremetal dependency on MachineAPI capability #1051
NO-JIRA: Update OWNERS #1058
OCPBUGS-35464: Updating cluster-version-operator-container image to be consistent with ART for 4.17 #1056
Revert “OCPBUGS-34287: Updating cluster-version-operator-container image to be consistent with ART for 4.17” #1055
NO-JIRA: typo change previousily to previously #1054
OCPBUGS-34287: Updating cluster-version-operator-container image to be consistent with ART for 4.17 #1047
OCPBUGS-35236: Revert: Add support for Custom Certificate Authorities for custom signature stores” #1052
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

configmap-reloader

append .0 to go.mod version #70
OCPBUGS-34355: Updating configmap-reload-container image to be consistent with ART for 4.17 #62
OCPBUGS-34355: Updating configmap-reload-container image to be consistent with ART for 4.17 #61
Full changelog

console

OCPBUGS-127155: [release-4.17] inkify-it: Denial of Service via crafted mailto: links #17382
Fix for OCPBUGS-92069: CVE-2026-44990 #16718
OCPBUGS-78672: Namespace is not persisting when switching to developer view from the topology page of admin page #16160
OCPBUGS-98411: CVE-2026-59869 bump js-yaml #17086
OCPBUGS-100514, OCPBUGS-101790: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17059
OCPBUGS-100172: Prevent binary secret data corruption when editing #16879
OCPBUGS-105790: Disable shipwright e2e tests to unblock CI #16955
OCPBUGS-87986: [release-4.17] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16600
Fix for OCPBUGS-81600: CVE-2026-4800 #16564
OCPBUGS-84283: Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 #16738
OCPBUGS-77124: [release-4.17] CVE-2026-26996 Bump minimatch library #16345
OCPBUGS-79443: Bump immutable #16326
NO-JIRA: enable multi-architecture yarn builds #16419
CONSOLE-5011: migrate to yarn berry #16074
NO-JIRA: Bump builder image to v29 #15994
OCPBUGS-74452: Bump lodash to latest #15966
OCPBUGS-69403: Disallowed Pipelines-plugin Pipelines navigation section #15849
OCPBUGS-65933: Preserve URL in perspective switch + remove dev console folks from reviewers #15762
OCPBUGS-64942: Expose prometheus tenancy label path as a proxy #15710
OCPBUGS-64599: Remove required flag from ‘console.flag/model’ pipelines-plugin extension #15665
OCPBUGS-62631: /auth/error?error=missing_state&error_type=auth is showing blank page #15554
OCPBUGS-63212: switch to dev perspective for /dev-monitoring #15614
OCPBUGS-63397: fix bug where Roles list was displaying invalid data f… #15627
OCPBUGS-62282: Fix desync of console and variable namespace #15545
OCPBUGS-44154: bump dompurify to latest #15590
OCPBUGS-61737: Remove ancient X-XSS-Protection header #15494
OCPBUGS-54241: VolumeSnapshots are not displayed in OpenShift Web Console #15465
OCPBUGS-59747: OpenShift console PVC clone cannot use B as the unit #15324
NO-JIRA: Increase the timeout on the cypress test #15420
OCPBUGS-58365: change ‘/metrics/usage’ endpoint to ‘/api/metrics/usage’ #15271
OCPBUGS-59544: Secret key with binary file changes when edited via Console #15301
OCPBUGS-59784: Update the golang.org/x/crypto/ssh to 0.31.0 in the openshift-console image #15329
OCPBUGS-58337: Tolerate unknown fields in Infrastructur… #15236
OCPBUGS-59492: Cannot read properties of undefined (reading ‘node-role.kubernetes.io/master’) error while accessing node logs from console #15294
OCPBUGS-59879: add data-test attrs to console plugins … #15338
OCPBUGS-59510: Not able to launch terminal window from OCP web console due to console plugin conflicts #15297
OCPBUGS-59265: fix bug where / in console.tab/horizontalNav href brea… #15270
OCPBUGS-58318: Implement sessions in openshift authenticator #15238
OCPBUGS-58224: Add the ability to launch multiple modals with useModal hook #15222
OCPBUGS-58378: Cannot read properties of undefined (reading ‘filter’) error while accessing nodes from console. #15241
OCPBUGS-57835: Add flags in console static plugin for all the components of this epic #15192
OCPBUGS-57932: Fix TypeError Cannot read properties of null (reading ‘metadata’) #15197
OCPBUGS-57182: Fix ‘/metrics’ endpoint token review to handle interna… #15154
OCPBUGS-56895: HorizontalPodAutoscalers via console require CPU resource limit even though HPAs use requests for scaling #15108
OCPBUGS-57095: Add all files to vendor regardless of gitignore #15132
OCPBUGS-57114: Debug pod logs are not accessible when debugging a node via OpenShift Console #15142
OCPBUGS-56975: Sample segment sessions #15114
OCPBUGS-56844: Enable knative tests #14387
OCPBUGS-56375: remove 60 day alert from cluster update modal #15062
OCPBUGS-55924: Fetching taskRuns in PLR details page using PLR UID also #15029
OCPBUGS-55756: update the Deployment pod on change in imageStream #15022
OCPBUGS-56238: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15049
OCPBUGS-55447: Authenticate user token in openshift Authenticate func #15010
OCPBUGS-55415: fix bug where operator appears twice #15002
OCPBUGS-55202: Do not load CSRs if user does not have permissions #14985
OCPBUGS-52999: Pipeline visualisation shows all tasks as Failed and after that goes to Running state #14862
OCPBUGS-53168: Remove logoutOpenShift method call #14883
OCPBUGS-51277: Fix JSON annotation parsing issue and harden related code #14795
OCPBUGS-53086: Update the monitoring topic used by the console team #14871
OCPBUGS-52205: Show Observe section without PROMETHEUS and MONITORING flags #14811
OCPBUGS-51292: fix run time error when no completed version exists #14796
OCPBUGS-51126: Fix alert rule link to alert in dev perspective #14785
OCPBUGS-49795: ‘create a Project’ button on Getting started page doesn’t work #14714
OCPBUGS-39602: Set default build option as BUILDS for Builder Image sample #14241
OCPBUGS-45740: Fix Function Import: An error occurred Cannot read properties of undefined (reading ‘filter’) #14595
OCPBUGS-45625: use default StorageClass for ServerlessFunction pipelineVolumeClaimTemplate #14589
OCPBUGS-41596: No need to supply ‘User workload notifications’ option on ‘User Preference’ page for normal user #14265
OCPBUGS-44220: disable flaking and change pre-condition test for knative e2e #14467
OCPBUGS-43751: Added token to proxy header #14430
OCPBUGS-48161: ERROR in search tool: Cannot read properties of undefined (reading ‘state’) #14667
OCPBUGS-48227: fix navigation from non-General User Preference tab to… #14674
OCPBUGS-41672: Update vendor imports to include all PatternFly components #14272
OCPBUGS-46344: OCP web console show pod status as Init:0/1 after using Native sidecars #14616
OCPBUGS-47497: Getting Oh no, something went wrong error when trying to install operator. #14645
OCPBUGS-43673: Disable GQL introspection #14640
OCPBUGS-45949: ReRun of Resolver based PipelineRuns fails from UI #14605
OCPBUGS-45954: Fixed capitalization in OpenShift Lightspeed #14607
OCPBUGS-45948: ImagePullSecret getting duplicated when editing DeploymentConfig in Form View #14604
OCPBUGS-45667: Do not pass CSV name to operand list page when an exen… #14591
OCPBUGS-46000: The description and name for GCP Pool ID is not consist #14611
OCPBUGS-42558: Plugins that use very old PF4 dropdown or menu components with grouped items have bullets and padding that needs to be removed. #14344
OCPBUGS-44656: update ConditionalUpdates release type #14505
OCPBUGS-43888: While accessing the node terminal from UI observed ‘Warning alert:Admission Webhook Warning` #14444
OCPBUGS-43441: fix table combination #14546
OCPBUGS-44169: use TaskRuns results.tekton.dev/record annotation to get the logs #14538
OCPBUGS-44873: Unable to remove finally tasks in pipeline builder mode #14527
OCPBUGS-42791: Add missing pipelines plugin name to known plugins #14377
OCPBUGS-44699: Add multiline support to template instantiation #14508
OCPBUGS-44183: Remove ClusterTask dependency in console from Pipelines 1.17 #14512
OCPBUGS-44764: Add IBM Block Storage CSI driver support for RWX #14517
OCPBUGS-43795: While upgrading the cluster from UI observed Warning alert:Admission Webhook Warning #14433
OCPBUGS-44722: include external labels so silenced alerts not displayed in notifications #14511
OCPBUGS-44358: BuildConfig form breaks on manually enter the Git URL #14478
OCPBUGS-43073: Telemetry userPreference results in empty nodes output to the DOM #14392
OCPBUGS-44587: Start last run do not work in buildConfig details page #14499
OCPBUGS-44586: Collapse/Expand Feature Added, Removal Option Removed in Version 4.16 #14498
OCPBUGS-44450: Don’t request user settings configmap if no user has been loaded. #14482
OCPBUGS-44479: conditionally display MachineConfig details page Confi… #14488
OCPBUGS-43878: Add flag to hide the pipelines-plugin pipeline builder extensions #14457
OCPBUGS-42824: remove axios as it is no longer in use #14381
OCPBUGS-42955: Enabling topology e2e tests on CI #14402
OCPBUGS-43009: Project is “Undefined” on “VolumeSnapshot” create page #14389
OCPBUGS-42607: add role exclusion to avoid unexpected triggering the namespace menu #14351
OCPBUGS-42606: make createdBy mandatory and auto fill with the current user #14352
OCPBUGS-42585: Red Hat Camel K Operator installation via cli #14346
OCPBUGS-42299: Increase login flow state paramater length/entropy #14318
OCPBUGS-42391: change “Partial cluster update” to “Control plane onl… #14323
OCPBUGS-42380: Allow operators to enable monitoring by default #14316
OCPBUGS-42060: Console crashes when ssh is selected in add secret for starting a pipeline run #14301
OCPBUGS-42223: restore Spotlight removal on next click #14314
OCPBUGS-39181: add Create button to Console plugins tab #14220
OCPBUGS-39091: update Events ChipGroup to use integrated close #14211
OCPBUGS-38563: do not directly mutate links in useMemo #14159
OCPBUGS-41685: Topology screen crashes when completed pod is selected #14276
OCPBUGS-41482: Unit Tests for the new Ask Lightspeed Button #14249
OCPBUGS-39601: Console user settings resources misses ownerRef, removing a user results in remaining data #14240
OCPBUGS-41893: Disable Extension Catalog tech preview nav item #14289
OCPBUGS-39110: List of default Camel K event sources disappears when adding a custom event source #14214
OCPBUGS-41684: Fix access mode selection menu issue #14277
OCPBUGS-41350: Update Lightspeed logo to new standards #14245
OCPBUGS-41480: improve layout and findability of Hide Lightspeed pref… #14248
OCPBUGS-39453: Use vCenterCluster value from CM as primary resource #14235
OCPBUGS-39109: Need to allow blank for Project/namespace when setting SA Subject in ‘Project access tab’ #14213
OCPBUGS-38903: Networking section depends on networking-console-plugin #14185
OCPBUGS-38300: Add telemetry to Lightspeed console capability #14129
OCPBUGS-38591: Add support for GCP Workload Identity / Federated identity operator installs #14160
OCPBUGS-38427: fix bug where cluster version text appears black in da… #14145
OCPBUGS-38615: improve Lightspeed popup contents and navigation #14163
OCPBUGS-38395: A value submitted in From view is wrapped with single quotation after switching to Yaml view. #14141
OCPBUGS-38394: Unrelated readme opened when opening CodeReady workspaces from Quarkus using s2i quickstart #14140
OCPBUGS-38691: Modifying helm e2e test to fix CI issue #14169
OCPBUGS-38412: Values entered into the Instantiate Template form are automatically cleared #14143
OCPBUGS-38644: Add the signals correlation to the app launcher #14161
OCPBUGS-38462: 2 Metrics tab in 4.17 developer console #14149
OCPBUGS-38389: correct casing in “Lightspeed” #14139
OCPBUGS-38240: Disable “Helm release status verification: HR-01-TC04” test due to CI outage #14126
OCPBUGS-38036: Properly chain trap commands #14111
CONSOLE-4104: Implement basic OLM V1 catalog view with filtering #14056
CONSOLE-3970: add Lightspeed button #14030
OCPBUGS-37426: No documentation covering how to translate plugin messages #14081
NO-JIRA: Update Console plugin SDK package changelogs post publish #14104
ODC-7632: Combine Shipwright model pages #14029
ODC-7626: Web Terminal Operator installation via cli #14009
ODC-7648: Open Lightspeed Chat Interface by clicking a button on the YAML Editor component #14087
OCPBUGS-30889: No access to list pipelines.tekton.dev prevents from using Delete application form #13942
OCPBUGS-36872: Add base path to locale init #14046
OCPBUGS-37802: Build option is selected as Shipwright on edit if created the deployment using BuildConfig #14101
OCPBUGS-36619: Switch to use annotations as labels from PipelineRuns created through Pipelines as Code is deprecated #14034
ODC-7634: Test all current workflows, write Integration tests #14075
OCPBUGS-36816: Include PatternFly-4 chart styles so they are available for dynamic plugins that still use PF4 react-charts #14080
CNV-41506, OCPBUGS-37403: Localnet NAD incorrectly displayed #13948
ODC-7640: Remove Alerting Details Page from Console #14072
CONSOLE-4098: Show deprecated operators in OperatorHub (Post-installation screens) #14048
OCPBUGS-35301: add missing translation in TriggerBindingSection #14062
OCPBUGS-23332: Fix utilization card limits/total display #14053
CNV-35124, OCPBUGS-37401: OVN Kubernetes multi-homing #14044
ODC-7621, ODC-7633: Add Shipwright as Build Options in Add & Edit Forms #14016
CONSOLE-4171: i18n upload/download routine task - sprint 256 #14054
Add dynamic plugin SDK package changelogs & update plugin docs #14012
OCPBUGS-37054: hide ‘View all steps in documentation’ for ROSA and OSD #14061
OCPBUGS-33801: Manually create an API token for a ServiceAccount #14038
ODC-7639: Remove alerts list from dev console codebase #14014
ODC-7624, ODC-7628: shipwright test improvement #13990
OCPBUGS-34387: maintain session across tabs #14041
OCPBUGS-34901: ensure correct API version for OperandDetails #14036
OCPBUGS-36801: disable serverless tests till further investigation #14042
ODC-7620: Modal submit button: show loading state #14007
OCPBUGS-35940: Create RoleBinding will trigger Admission Webhook Warning #14021
OCPBUGS-34956: increase namespace deletion timeout for k-native e2e tests #14039
CONSOLE-4060: Show deprecated operators in OperatorHub (Pre-installation screens) #13961
OCPBUGS-34956: disable failing knative e2e test #14019
OCPBUGS-35926: Add debounce to PAC auto selecton in git import flow #14011
OCPBUGS-30841: Redirects to new PipelineRun logs URL from old PipelineRun logs URL #14032
OCPBUGS-36260: Tooltip on Pipeline when expression is not shows #14023
OCPBUGS-31047: Reordered dependancy warning to fix the lint error #13993
ODC-7612: Serverless Operator installation via CLI #13949
OCPBUGS-36339: Fix “Auto deploy when new image is available” becomes unchecked when editing a deployment from web console #14024
CONSOLE-4140: display URI decoded configuration files on MachineConfi… #14015
OCPBUGS-36424: DeploymentConfigs deprecation info alert should not present on the Edit deployment page #14025
OCPBUGS-31685: Revert - terminal: use username if uid is not present #13719
OCPBUGS-35284: fix BMH restart annotation #13995
CONSOLE-4134: i18n upload/download routine task sprint - 255 #13991
OCPBUGS-35879: Fix TypeError: Cannot read properties of null (reading ‘metadata’) in Topology view #14017
CONSOLE-3792: Add extension point to enable customized create project modal for dynamic plugins #13825
OCPBUGS-33490: Update Docs links for “Learn More” in Display Warning Policy Notification #14002
ODC-7581: Gitea support when using Import from Git in Developer Console #13928
OCPBUGS-35928: Improve control over PatternFly shared modules used in Console plugins #13992
OCPBUGS-35999: Remove duplicate code in storage module #14004
OCPBUGS-35996: remove orphaned i18n files #14001
ODC-7627: Move test-cypress script into a frontend sub-folder to make it easier to approve changes #13937
OCPBUGS-35908: fix flaking crd-extension tests #14000
ODC-7613: Update the UI for selecting the Git Provider in the Import form #13936
CONSOLE-3824: Remove kubevirt-plugin code #13769
ODC-7585: Pipeline operator installation via CLI #13909
OCPBUGS-33136: Fix invalid node filesystem query #13924
OCPBUGS-34316: Manually Approve client CSR displays an unknown warning message #13939
RHSTOR-5836: add info for ODF use-case (LSO LocalVolumeSet “Create” page) #13965
OCPBUGS-34937: Violation warning is not displayed for minAvailable in PDB Create/Edit form #13935
OCPBUGS-32550: Fix placement of icons on WebKit #13987
ODC-7614: Port exposed in Dockerfile not observed in the Ports Dropdown in Git Import Form #13953
OCPBUGS-35418: Error with html escaping for Route helptext #13980
OCPBUGS-35497: Update Go prereq in README.md #13979
OCPBUGS-34986: remove duplicate OAuth config #13957
ODC-7596: Show Pod Disruption warning message in Topology page #13921
OCPBUGS-35492: add info on obtaining first preferred language #13976
OCPBUGS-34516: Improve catalog grid icon display and scaling #13901
CONSOLE-4115: Add OLM v1 package #13960
OCPBUGS-25929: Fix: Quick Start “next” button requires double click to move to next step #13934
OCPBUGS-22853: Keep useUserSettings hook in the internal api #13967
OCPBUGS-29804: Fix crash if helm chart metadata is nil #13963
OCPBUGS-30218: fix pseudolocalization #13964
OCPBUGS-35376: sessions: fix sessions pruning #13903
OCPBUGS-35287: Alphabetize icons, alias httpd to apache #13958
OCPBUGS-29499, OCPBUGS-29804: bump helm to 3.14.4 #13816
(chore) Update tectonic builder image to use golang-1.22 #13932
OCPBUGS-29744: Removed nested label component #13946
OCPBUGS-34752: Forward selected key prop in IconDropdown component #13919
OCPBUGS-34683: Ensure requiredVersion is set for Console provided shared modules #13893
OCPBUGS-33756: Display of “Auth Token GCP” filter in OperatorHub should be conditioned #13867
OCPBUGS-35080: replace global refresh sync lock in OIDC provider with per-refresh-token one #13655
NO-JIRA: Remove Edge from devconsole_pr.md #13943
NO-JIRA: docs: update dead links in docs/helm #13904
OCPBUGS-35031: restore missing CloseButton styles #13941
OCPBUGS-34862: Fix Inconsistent Capitalization of “Import from Git” #13925
OCPBUGS-34684: i18n upload/download routine task - Sprint 254 #13910
OCPBUGS-29777: RWOP accessMode is not available on OpenShift console UI #13829
OCPBUGS-34656, OCPBUGS-34791, OCPBUGS-34828: disabling add-flow A-04-TC01 test and knative tests due to flakes #13931
OCPBUGS-34958: Replace Red Hat catalog source with Community #13938
OCPBUGS-33539: Add default sorting column for VirtualizedTable component of dynamic plugin sdk #13916
OCPBUGS-34533: Fix updating the “Until” field on the Silence > Edit page #13926
CONSOLE-3662, CONSOLE-4097, OCPBUGS-34538: Update plugin docs regarding Console 4.16 shared module changes #13900
NO-JIRA: revert “Add username/uid label and annotation for the user setting ConfigMap, Role and RoleBinding” #13917
OCPBUGS-33747: console always query ‘openshift’ CSVs when listing namespaced operator details #13912
OCPBUGS-33733: The s2i build strategy is not assumed for Serverless Functions #13889
OCPBUGS-19855: Validate watchK8sObject query must have name and namespace for namespaced resources #13876
OCPBUGS-29215: Update console cookies to use SameSite strict mode. #13878
OCPBUGS-33631: show “Debug container” link for pods with status.phase… #13850
OCPBUGS-32698: Remove TELEMETRY_DISABLED check from console telemetry… #13808
OCPBUGS-34170: Updating openshift-enterprise-console-container image to be consistent with ART for 4.17 #13896
OCPBUGS-32321: Add username/uid label and annotation for the user setting ConfigMap, Role and RoleBinding #13798
OCPBUGS-34222: Fix for cypress local auth issue #13895
OCPBUGS-32950: Restore user toggle when authentification is disabled #13797
OCPBUGS-34052: Include English Translations text for Supported Languages in User Preference Dropdown #13877
OCPBUGS-34200: fix bug where textarea is not resizable #13892
CONSOLE-4085: Updated oc client link in readme #13888
OCPBUGS-34170: Updating openshift-enterprise-console-container image to be consistent with ART for 4.17 #13886
ODC-7432: Remove pf classnames from gitops integration test #13845
HELM-532: Sort on basis of Chart Version #13846
OCPBUGS-32632: Improve Pipeline list page performance #13842
OCPBUGS-33090: UI inconsistency in topology when application grouping is collapsed #13858
OCPBUGS-32476: Import from Git allow users to import an app with Build option Pipeline also when no Pipeline is available #13853
OCPBUGS-33383: Fix Admission webhook warning for Route and BuildConfig creation via import flow #13828
OCPBUGS-32405: Create Serverless form does not create BuildConfig #13775
NO-ISSUE: metal3: update OWNERS #13635
OCPBUGS-29510: Fix console crash-loop with OIDC auth config #13713
OCPBUGS-33717: Use bridge instead of cnv-bridge #13854
OCPBUGS-33636: Updating the secrets using Form editor displays an unknown warning message #13852
OCPBUGS-33587: Fix password set to Secret created through Start Pipeline form #13844
OCPBUGS-33869: i18n - Download and merge French and Spanish languages translations in the OCP Console #13861
CONSOLE-4058: add user-impersonation to QuickStartGettingStartedCard,… #13862
And 18 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-103205: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1224
OCPBUGS-77862: update go mod dependency for konflux #1114
OCPBUGS-60298: Update downloads deployment configuration to use master node selector #1033
OCPBUGS-45302: console/status: set initial value of Message field #943
OCPBUGS-46390: Dont disable console when authConfig type is set to None #951
OCPBUGS-38728: Get externalOrganizationID instead of the organizationID #926
OCPBUGS-36213: Vendor proper commit #928
CONSOLE-4163: Add RBAC for console to GET PackageManifests #921
CONSOLE-4161: Add Capabilities to config builder #920
OCPBUGS-35941: Bump documentationBaseURL to 4.17 #912
OCPBUGS-36213: Bump openshift/api to pick up removal of conversion webhook server reference #919
OCPBUGS-33715: Add logging for determining the ORG_ID source #918
OCPBUGS-33715: Cache organization ID when the ID changes #913
TRT-1733: Revert #914 “OCPBUGS-29547: Apply hypershift cluster-profile for ibm-cloud-managed” #915
OCPBUGS-29547: Apply hypershift cluster-profile for ibm-cloud-managed #914
OCPBUGS-33787: Add cluster wide trusted CA bundle to operator #911
OCPBUGS-33787: Tolerate the absence of ingress capability on HyperShift clusters #886
OCPBUGS-33787: deps: bump openshift/api #907
AUTH-482: set required-scc for openshift workloads #871
OCPBUGS-34364: Updating openshift-enterprise-console-operator-container image to be consistent with ART for 4.17 #906
OCPBUGS-31777: Updates message verbs to use %q where appropriate. #902
OCPBUGS-33715: Cache organization ID #904
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85671: CI Build root image tag sync with ART #235
OCPBUGS-68135: Bump logrus to v1.9.1 #224
OCPBUGS-55622: Check error returned by ipv6 SettleAddresses #187
NP-1042: Update owners #164
OKD-218: install util-linux #165
Full changelog

coredns

OCPBUGS-103200: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #206
OCPBUGS-62825: UPSTREAM: 7083 and 6836: Fix failing TestZoneExternalCNAMELookupWithProxy #155
append .0 to go.mod version #135
NE-1721: Merge 1.11.3 #118
OCPBUGS-33750: UPSTREAM: <carry>: openshift: Bump the version of ocp_dnsnameresolver external plugin #122
OCPBUGS-34619: UPSTREAM: 6692: openshift: Fix OCPBUGS-34619 #121
OCPBUGS-34169: Updating coredns-container image to be consistent with ART for 4.17 #120
OCPBUGS-34169: Updating coredns-container image to be consistent with ART for 4.17 #119
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-103277, OCPBUGS-103279: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork- #421 #421
OCPBUGS-80134: Bump google.golang.org/grpc #388
OCPBUGS-68209: fix CVE-2025-65637 #357
OCPBUGS-58839: CARRY: don’t ignore json files #340
OCPBUGS-52416: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #319
OCPBUGS-43427: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #314
OCPBUGS-43427: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.30 into release-4.17 #302
OCPBUGS-34113: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.17 #292
OCPBUGS-34113, OCPBUGS-34137, OCPBUGS-34460, OCPBUGS-35462: sync upstream on release-1.30/go1.22 #287
NO-JIRA: Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.29 into master #284
NO-JIRA: Remove dulek from shiftstack-team #279
OCPBUGS-34113: Updating ose-openstack-cinder-csi-driver-container image to be consistent with ART for 4.17 #280
Full changelog

csi-driver-manila-operator

OCPBUGS-103201: Use patched x/net fork v0.35.0-sec.4 #263
OCPBUGS-38457: Add missing healthchecks #240
AUTH-482: set required-scc for openshift workloads #234
STOR-1596: Bump all deps for 4.17 #233
OCPBUGS-34090: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.17 #232
OCPBUGS-34090: Updating csi-driver-manila-operator-container image to be consistent with ART for 4.17 #231
Full changelog

csi-driver-nfs

OCPBUGS-82708: Bump github.com/moby/spdystream@v0.5.1 #195
OCPBUGS-80077: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #181
append .0 to go.mod version #156
OCPBUGS-34363: Updating csi-driver-nfs-container image to be consistent with ART for 4.17 #144
NO-JIRA: Merge https://github.com/kubernetes-csi/csi-driver-nfs:master into master #140
OCPBUGS-34363: Updating csi-driver-nfs-container image to be consistent with ART for 4.17 #142
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

append .0 to go.mod version #372
OCPBUGS-34217: Updating ose-csi-driver-shared-resource-container image to be consistent with ART for 4.17 #188
OCPBUGS-44510: Updating ose-csi-driver-shared-resource-webhook-container image to be consistent with ART for 4.17 #233
Updating Readme to add a new Clusterrole #190
NO-JIRA: Clarify Personas for Sharing #185
OCPBUGS-34472: Updating ose-csi-driver-shared-resource-mustgather-container image to be consistent with ART for 4.17 #189
OCPBUGS-34217: Updating ose-csi-driver-shared-resource-container image to be consistent with ART for 4.17 #187
Full changelog

csi-driver-shared-resource-operator

OCPBUGS-103198: Bump golang.org/x/net to v0.35.0-sec.3 #127
OCPBUGS-80080: Bump google.golang.org/grpc to v1.79.3 #125
STOR-1596: Bump all deps for 4.17 #114
Full changelog

csi-external-attacher

OCPBUGS-103210: Bump golang.org/x/net to v0.35.0-sec.4 #116
OCPBUGS-80082: Bump google.golang.org/grpc to v1.79.3 #106
STOR-1593: Rebase external-attacher to v4.6.1 for OCP 4.17 #76
OCPBUGS-36455: Rename Dockerfile to Dockerfile.ocp #77
OCPBUGS-34440: Updating csi-attacher-container image to be consistent with ART for 4.17 #75
OCPBUGS-34098: Updating csi-attacher-container image to be consistent with ART for 4.17 #74
Full changelog

csi-external-provisioner

OCPBUGS-92864: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.5 to address CVE-2026-46597 #162
OCPBUGS-82709: Address CVE-2026-35469 #142
OCPBUGS-80083: Bump google.golang.org/grpc #131
STOR-1593: Rebase to upstream v5.0.2 for 4.17 #104
OCPBUGS-34458: Updating csi-provisioner-container image to be consistent with ART for 4.17 #103
OCPBUGS-37455: Revert 5.0.1 rebase #102
STOR-1593: Rebase to upstream v5.0.1 for 4.17 #98
Full changelog

csi-external-resizer

OCPBUGS-80084: Patching openshift-sustaining/grpc-go v1.71.3-sec.1 #204
OCPBUGS-103208: Bump golang.org/x/net to v0.35.0-sec.4 #214
OCPBUGS-62466: Requeue PVC over PV creation #175
STOR-1593: Rebase to upstream v1.11.1 for 4.17 #164
OCPBUGS-34356: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.17 #163
OCPBUGS-34356: Updating ose-csi-external-resizer-container image to be consistent with ART for 4.17 #162
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-103212, OCPBUGS-103215: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #229
OCPBUGS-80085, OCPBUGS-80088, OCPBUGS-80089: Bump google.golang.org/grpc to v1.79.3 #214
OCPBUGS-60449: UPSTREAM: 1238: Snapshot Controller startup should not LIST all volumesnapshots #184
STOR-1593: Rebase external-snapshotter to v8.0.1 for OCP 4.17 #156
OCPBUGS-34257: Updating ose-csi-snapshot-validation-webhook-container image to be consistent with ART for 4.17 #158
OCPBUGS-34292: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 4.17 #159
OCPBUGS-34435: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.17 #157
OCPBUGS-34292: Updating ose-csi-snapshot-controller-container image to be consistent with ART for 4.17 #152
OCPBUGS-34257: Updating ose-csi-snapshot-validation-webhook-container image to be consistent with ART for 4.17 #151
OCPBUGS-34061: Updating ose-csi-external-snapshotter-container image to be consistent with ART for 4.17 #150
Full changelog

csi-livenessprobe

OCPBUGS-103203: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #110
append .0 to go.mod version #73
OCPBUGS-36456: Rename Dockerfile #67
OCPBUGS-34275: Updating csi-livenessprobe-container image to be consistent with ART for 4.17 #66
OCPBUGS-34275: Updating csi-livenessprobe-container image to be consistent with ART for 4.17 #65
Full changelog

csi-node-driver-registrar

OCPBUGS-63682: update log level verbosity to not clutter logs #90
append .0 to go.mod version #80
OCPBUGS-34361: Updating csi-node-driver-registrar-container image to be consistent with ART for 4.17 #74
OCPBUGS-34361: Updating csi-node-driver-registrar-container image to be consistent with ART for 4.17 #73
Full changelog

docker-builder

OCPBUGS-89852, OCPBUGS-90297, OCPBUGS-92380, OCPBUGS-92577, OCPBUGS-92854: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #548
OCPBUGS-66988: bump buildah to 1.37.7 to fix CVE-2025-52881 #499
OCPBUGS-65816: BuildConfig inline Dockerfile fails with heredoc syntax #488
OCPBUGS-57939: S2I build cpu limits observed by assemble are limited to 1 cpu #474
OCPBUGS-53075: Upgraded Kubernetes dependency from 1.28.2 to 1.30.2 #465
OCPBUGS-42894: buildah dependency bump to 1.37.6 #452
OCPBUGS-33889: Updating openshift-enterprise-builder-container image to be consistent with ART for 4.17 #393
OCPBUGS-47768: Add team members to the OWNERS file #423
OCPBUGS-47712: skipping some unit tests to avoid failures as they are duplicate #421
OCPBUGS-33215: Bumps openshift/api & related dependencies #394
OCPBUGS-25495: Upgrade s2i and buildah #392
Full changelog

docker-registry

OCPBUGS-103223: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #481
OCPBUGS-68182: update logrus to v1.9.1 #465
OCPBUGS-60090: bump docker distribution to fix purgeuploads panic #440
OCPBUGS-53655: bump jwt and oauth dependencies #431
OCPBUGS-49695: bump docker distribution #422
OCPBUGS-39040: pull upstream distribution changes to use a consistent multipart chunk size #409
OCPBUGS-36521: Rename Dockerfile #407
OCPBUGS-35335: use SelfAccessReview to obtain user info #404
OCPBUGS-34442: Updating openshift-enterprise-registry-container image to be consistent with ART for 4.17 #401
OCPBUGS-33453: Use SAR instead of SSAR #402
OCPBUGS-34115: Updating openshift-enterprise-registry-container image to be consistent with ART for 4.17 #399
Full changelog

driver-toolkit

Adding the + char to the RT kernel version. (#154) #154
Updating driver-toolkit-container image to be consistent with ART for 4.17 (#153) #153
ART bash parser is failing on [[…]] syntax (#151) #151
Patch manifests to require stream-coreos instead of rhel-coreos in the OKD/SCOS case (#149) #149
Full changelog

egress-router-cni

OCPBUGS-37730: Build rhel8 binary from rhel8 golang builder #88
OCPBUGS-35526: update to go 1.22 and k8s.io mods to v0.30 #84
OKD-217: install util-linux #82
Full changelog

etcd

DOWNSTREAM: <carry>: OCPBUGS-53447: fix a compaction induce latency issue #321
ETCD-714: Rebase etcd 3.5.18 openshift 4.17 #310
NO-ISSUE: Add support for cachi2 based deps #297
OCPBUGS-42680: Rebase etcd 3.5.16 openshift 4.17 #291
NO-JIRA: use golang 1.22 image #286
OCPBUGS-34653: Rebase etcd 3.5.14 openshift 4.17 #273
Full changelog

gcp-cloud-controller-manager

OCPBUGS-35256: Allow bootstrap node in existing instance groups #66
NO-JIRA: Update OWNERS #65
OCPCLOUD-2606: Merge https://github.com/kubernetes/cloud-provider-gcp:master (856e124) into master #57
OCPBUGS-30505: Bump protobuf to v1.34.1 #62
Full changelog

gcp-cluster-api-controllers

OCPBUGS-103229: Bump golang.org/x/net to github.com/openshift-sustaining/net v0.35.0-sec.4 CVE-2026-33814 [release-4.17] #322
OCPBUGS-80095: Bump google.golang.org/grpc to v1.79.3 #291
OCPBUGS-78279: [release-4.17] update go mod dependency for konflux #266
NO-JIRA: Update OWNERS #229
OCPCLOUD-2622: Merge https://github.com/kubernetes-sigs/cluster-api-provider-gcp:v1.7.0 (93bb59d) into master #228
Full changelog

gcp-machine-controllers

OCPBUGS-103253: Bump golang.org/x/net to v0.35.0-sec.3 #190
OCPBUGS-80118: Bump google.golang.org/grpc to v1.79.3 #166
OCPBUGS-53037: Disable shielded VMs for non-UEFI disks #115
OCPBUGS-48064: Refactor exists() to handle gcp API change #105
OCPBUGS-46082: update a2 gpu detection logic to be dynamic #100
OCPBUGS-43738: Add c4a instance as arm type #95
OCPCLOUD-2565: Bump o/api and MAO packages #87
NO-JIRA: Update OWNERS #85
OCPCLOUD-2613: Bump k8s to 1.30 #84
OCPBUGS-34381: Updating ose-machine-api-provider-gcp-container image to be consistent with ART for 4.17 #83
Full changelog

gcp-pd-csi-driver

OCPBUGS-103235: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #144
OCPBUGS-80099: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 #113
OCPBUGS-68186: Update logrus to 1.9.3 #90
STOR-1602: Rebase to upstream v1.14.1 for OCP 4.17 #68
OCPBUGS-34245: Updating ose-gcp-pd-csi-driver-container image to be consistent with ART for 4.17 #69
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-103225: Use patched x/net fork v0.35.0-sec.4 #217
OCPBUGS-80098: Replace google.golang.org/grpc with fork #188
CFE-879: Add resourceTags in Infrastructure to driver args list #120
STOR-1596: Bump all deps for 4.17 #124
OCPBUGS-34439: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART for 4.17 #123
OCPBUGS-34097: Updating ose-gcp-pd-csi-driver-operator-container image to be consistent with ART for 4.17 #121
Full changelog

haproxy-router

OCPBUGS-103220: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #845
OCPBUGS-86725: Prevent SSRF via FQDN-typed EndpointSlices #835
OCPBUGS-86714: Strip X-SSL-* headers for plain HTTP #804
OCPBUGS-80100: Address CVE-2026-33186 #779
OCPBUGS-49390: Reject All CA-Signed Certs Using SHA1 #650
OCPBUGS-49702: Add support for IdleCloseTerminationPolicy #652
OCPBUGS-38101: Bump k8s.io/* packages to v0.30.3 #615
OCPBUGS-34351: Updating ose-haproxy-router-base-container image to be consistent with ART for 4.17 #602
OCPBUGS-34471: Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 4.17 #604
Full changelog

hyperkube, pod

OCPBUGS-136162: Fix kubeadm preflight host URL construction #2842
OCPBUGS-68132, OCPBUGS-68190: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 #2573
OCPBUGS-72531: Skip E2e: attach on previously attached volumes should work #2566
OCPBUGS-65695: Fix Concurrentmap Iteration #2520
OCPBUGS-63460: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456 #2496
CNTRLPLANE-1611: Backport StreamingCollectionEncoding for JSON and protobuf #2486
OCPBUGS-61584: UPSTREAM: <carry>: Don’t retry storage calls with side effects. #2458
OCPBUGS-60552: [4.17] podresources: list: use active pods #2426
4.17: OCPBUGS-60998: scheduler: Improve CSILimits plugin accuracy by using VolumeAttachments #2434
OCPBUGS-57888: Bump k8s api to 1.30.14 #2355
OCPBUGS-57196: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2328
OCPBUGS-57289: kubelet: fix a stall on startup from waiting too long for a stat call #2206
OCPBUGS-55269: Bump k8s api to 1.30.12 #2280
OCPBUGS-53016: Bump k8s api to 1.30.11 #2250
OCPBUGS-51006: Bump k8s api to 1.30.10 #2210
OCPBUGS-49905: Bump k8s api to 1.30.9 #2198
: OCPBUGS-46364: Fix grace period used for immediate evictions #2164
OCPBUGS-46002: Bump k8s api to 1.30.7 #2160
OCPBUGS-39318: UPSTREAM: 126994: Add required FieldManager for validatingadmissionpolicy e2e #2070
OCPBUGS-43820: UPSTREAM: <carry>: kubelet/cm: fix bug where kubelet restarts from missing cpuset cgroup #2126
OCPBUGS-44897: Backport format library to enable usage in 4.18 #2140
OCPBUGS-44512: Bump k8s api to 1.30.6 #2134
OCPBUGS-42427: UPSTREAM: 125398: Fix issue with scheduler failing on hostname mismatch #2097
OCPBUGS-42640: Unrevert Bump k8s api to 1.30.5” #2107
OCPBUGS-42640: Revert #2089 “OCPBUGS-42167: Bump k8s api to 1.30.5” #2100
OCPBUGS-42167: Bump k8s api to 1.30.5 #2089
OCPBUGS-42019: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2087
OCPBUGS-41638: UPSTREAM: <carry>: bump cadvisor version to fix missing network stats #2081
OCPBUGS-39014: Bump 1.30.4 #2062
OCPBUGS-38363: UPSTREAM: 126470: Move APIServingWithRoutine to alpha and disabled by default #2053
NO-JIRA: update downstream owners #2048
OCPBUGS-37620: Bump 1.30.3 #2038
NO-JIRA: UPSTREAM: 126213: add test about container metrics from cadvisor #2040
OCPBUGS-37281: UPSTREAM: 126104: Add funcs in pkg/filesystem/util to set file permissions on Windows and update container log dir perms #2034
OCPEDGE-1181: UPSTREAM: <carry>: update test annotations for sno #2033
NO-JIRA: add tool to validate test packages imported #2024
OCPBUGS-36742: UPSTREAM: <carry>: sync imports #2017
OCPBUGS-37111: UPSTREAM: 125404: Fix that PodIP field is temporarily removed for a terminal pod #2025
NO-JIRA: UPSTREAM: <drop>: bump(github.com/openshift/apiserver-library-go) #2023
MULTIARCH-4229: UPSTREAM:<carry>:bump cadvisor for 3516 upstream patches #2012
OCPBUGS-36743: UPSTREAM: <carry>: inject k8s version from hyperkube Dockerfile #2018
OCPBUGS-34294: OCPBUGS-34309: UPSTREAM: <carry>: update base image #1998
API-1783: Bump 1.30.2 #1996
OCPBUGS-14613: drop carry “don’t fail integration due to too many goroutines” #1995
OCPBUGS-34544: UPSTREAM: <carry>: Disable PersistentVolumeLabel by default #1991
OCPBUGS-34050: Backport 125337 #1987
OCPBUGS-34544: UPSTREAM: <carry>: Disable e2e tests that need PersistentVolumeLabel #1986
OCPBUGS-34593: UPSTREAM: 124933: [Scheduler] Use allNodes when calculating nextStartNodeIndex #1983
API-1783: UPSTREAM: <carry>: skip PodLifecycleSleepAction test #1982
API-1783: UPSTREAM: <carry>: skip storage tests #1981
OCPBUGS-25331: UPSTREAM: <carry>: extend termination events #1827
API-1783: Bump 1.30.1 #1979
API-1783: Rebase 1.30.0 #1953
Full changelog

hypershift

Sync approver aliases with main for release-4.17 #10188
OCPBUGS-76289: CVE-2025-52881 openshift/hypershift multicluster-engine/hypershift-rhel9-operator: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [mce-2.7] #8292
OCPBUGS-99079: fix(backport): konnectivity agent auth #9104
OCPBUGS-89357: build(operator): drop hypershift-no-cgo from operator container images #8761
OCPBUGS-80103: fix https://github.com/advisories/GHSA-p77j-4mvh-x3m3 by replacing grpc-go #8516
OCPBUGS-84181: fix(cno): use brackets only for IPv6 in server URL #8347
OCPBUGS-76533: feat(updates): enable CVO metrics access with RHOBS monitoring flag #7703
OCPBUGS-74230, OCPBUGS-74294: [release-4.17] Support proxy authentication when user/pass is included in URL #7568
fix: OCPBUGS-72956: Fix Konflux EC voilation, update deprecated base … #7457
OCPBUGS-69865: test: remove unit tests that depend on network communication [release-4.17] #7411
OCPBUGS-57123: Add support for registry root entry only in the IDMS/ICSP #6230
CNTRLPLANE-1903: Migrate 4.17 pipelines to use common pipeline #7215
OCPBUGS-63639: [release-4.17] fix(konnectivity): resolve circular dependency causing DNS timeouts and excessive retries #7112
OCPBUGS-64604: Update DNS names for ovn-kubernetes cp metrics #7150
OCPBUGS-63370: fix: Make the hypershift CLI binary FIPS-compliant #7094
CNTRLPLANE-1425: feat(konflux): tag MCE HO images with latest #6838
OCPBUGS-57143: [release-4.17] HCP payload doesn’t respect multiple mirrors #6771
OCPBUGS-61290: Update KCM node monitor grace period #6760
OCPBUGS-61208: use common MCE konflux pipeline #6749
OCPBUGS-60149: [release-4.17] Always compress and encode payload in token secret for inplace upgrades #6740
OCPBUGS-61101: Use system trust bundle in CPO IDP https client #6735
OCPBUGS-60921: konflux for hcp-cli #6699
CNTRLPLANE-1204: HO MCE change to hermetic ta build #6653
CNTRLPLANE-1230: Move CPO pipeline to hermetic builds #6598
CNTRLPLANE-936: fix(tekton): drop multiarch builds on PR #6224
OCPBUGS-57432: Add proxy variables for the MCD Pod #6258
CNTRLPLANE-918: Konflux build pipeline service account migration #6088
CNTRLPLANE-918: Konflux build pipeline service account migration #6083
OCPBUGS-55723: Don’t check if olm images exist if guest cluster #6115
OCPBUGS-55500, RHOCPPRIO-433: Add validation to avoid conflicts between KubeAPIServer and NamedCertificates SANs #6098
OCPBUGS-51808: Fix golang crypto dependency go.mod replacement #5993
OCPBUGS-54841: Add konnectivity-proxy sidecar to openshift-oauth-apiserver #6017
OCPBUGS-53323: Handle multiple mirror entries for source #5894
OCPBUGS-54631: Sync RBAC for attaching volumes on VM level #5997
NO-JIRA: update konflux references #5479
OCPBUGS-53903: bump golang-jwt v4 and v5 #5906
NO-JIRA: Red Hat Konflux update control-plane-operator-4-17 #5959
ART-11792: update go mod dependency for konflux #5920
OCPBUGS-51737, OCPBUGS-51808: Bump dependencies to OCP fork in backports #5900
OCPBUGS-48439: kubevirt, Don’t break on hostname NodePort.Address #5394
OCPBUGS-51240: bump go-jose #5863
OCPBUGS-52657: Make managed-trust-bundle optional #5794
OCPBUGS-52425: [release-4.17] refactor aws identity health check into new controller #5772
OCPBUGS-46340: change plaform to platform #5562
OCPBUGS-51339: [release-4.17] Fix IsProgressing condition in HostedClusters #5712
OCPBUGS-50697: add region to AWS creds passed to operators managed by CPO #5671
OCPBUGS-51098: 4.17 Add HostedCluster additional trustbundles to konnectivity-https-proxy #5675
NO-JIRA: Update dependency mkdocs-material to v9.6.5 #5682
OCPBUGS-50596: Honor proxy vars in the util insecure http client #5605
OCPBUGS-49828: Duplicate hostDevices.name when hostDevices.deviceName has multiple types. #5558
OCPBUGS-48487, OCPBUGS-48488, OCPBUGS-48490: Fix IPv6 Disconnected HCP deployments #5402
OCPBUGS-47533: Prevent IgnitionServer from flooding the API server with patch requests #5332
NO-JIRA: Update dependency mkdocs-material to v9.6.3 #5590
OCPBUGS-45268: Reconcile proxy CA bundle into hosted cluster #5228
OCPBUGS-46465: Consistently look up and dial cloud API hostnames #5302
NO-JIRA: Update dependency mkdocs-material to v9.6.1 #5528
OCPBUGS-49638: fix overwriting PKI operator HCP conditions #5504
OCPBUGS-46440: Allow ARM64 arch deployment on Agent platform #5296
OCPBUGS-48170: fix disconnected via CLI #5465
OCPBUGS-38810: nodepoolcontroller: List() PerformanceProfile status per NodePool #4585
NO-JIRA: Update dependency mkdocs-mermaid2-plugin to v1.2.1 (release-4.17) #5428
NO-JIRA: Update dependency mkdocs-material to v9.5.50 (release-4.17) #5427
OCPBUGS-44927: Add multi-arch validation for HC/NodePool compatibility #5238
NO-JIRA: [release-4.17] Bump golang.org/x/crypto and golang.org/x/net #5368
NO-JIRA: Update Konflux references (release-4.17) #5329
OCPBUGS-46412: Separate CPO containerfiles #5285
NO-JIRA: chore(deps): update konflux references (release-4.17) #5289
NO-JIRA: chore(deps): update dependency mkdocs to v1.6.1 (release-4.17) #5290
OCPBUGS-44114: Add external kas address to no proxy skip list #5028
NO-JIRA: Red Hat Konflux update hypershift-release-mce-28 #5174
NO-JIRA: chore(deps): update konflux references (release-4.17) #5249
OCPBUGS-44630: Use ingress role in private link controller for DNS operations #5142
NO-JIRA: chore(deps): update konflux references (release-4.17) #5183
NO-JIRA: chore(deps): update konflux references (release-4.17) #5154
NO-JIRA: chore(deps): update konflux references (release-4.17) #5144
OCPBUGS-44184: dont use registryOverrides on kube rbac proxy image be… #5033
NO-JIRA: chore(deps): update konflux references (release-4.17) #5113
OCPBUGS-43929: Return the right tagReference on Catalogs ImageStream #4993
OCPBUGS-44276: Configure OAuth https proxy to dial cloud endpoints directly #5070
OCPBUGS-44268: Fix order rendering HCP objects #5064
NO-JIRA: Update Konflux references (release-4.17) #5098
chore(deps): update konflux references (release-4.17) #5075
HOSTEDCP-2046: CPO 4.17 tekton builds #5006
NO-JIRA: chore(deps): update konflux references (release-4.17) #5053
NO-JIRA: Update Konflux references to fedcfe0 (release-4.17) #5041
chore(deps): update konflux references (release-4.17) #5023
chore(deps): update konflux references to f53fe54 (release-4.17) #5018
NO-JIRA: Update Konflux references (release-4.17) #5009
OCPBUGS-42879: Add network policies for konnectivity server and ignition server proxy #4865
NO-JIRA: bump catalog operators version #4992
NO-JIRA: chore(deps): update konflux references (release-4.17) #4972
OCPBUGS-43746: add ValidIDPConfiguration condition to report IDP config issues #4969
NO-JIRA: chore(deps): update konflux references (release-4.17) #4958
OCPBUGS-43464: Pass feature flags to clusterpolicy controller #4928
NO-JIRA: chore(deps): update konflux references (release-4.17) #4931
OCPBUGS-42704: Run 2 replicas of active/passive HA components #4843
OCPBUGS-43316: Enforce privileged PSA by default #4834
NO-JIRA: chore(deps): update konflux references (release-4.17) #4921
OCPBUGS-43374: release-4.17 openstack/e2e: re-work nodepool tests #4914
NO-JIRA: chore(deps): update konflux references to 674e70f (release-4.17) #4907
NO-JIRA: chore(deps): update konflux references (release-4.17) #4895
OCPBUGS-43051: Use guest DNS resolution in Konnectivity HTTPS proxy by default #4885
HOSTEDCP-2020: [release-4.17] Add support for SharedVPC #4873
HOSTEDCP-2023: [release-4.17] Split worker and vpc endpoint security groups #4882
OCPBUGS-42974: [release-4.17] Do not send traffic to local audit-webhook through konnectivity #4869
NO-JIRA: Remove EnsurePSANotPrivileged check #4855
OCPBUGS-42714: label routes only when HCP router used #4845
NO-JIRA: chore(deps): update konflux references to 37b9187 (release-4.17) #4854
OCPBUGS-42390: Add Annotation to skip deleting hcp namespace #4792
NO-JIRA: chore(deps): update konflux references (release-4.17) #4812
NO-JIRA: e2e: openstack: fix nil deref in route53 teardown #4810
OCPBUGS-42261: Conditionally manage kubeconfig secrets for DNS and Ingress operators #4764
OCPBUGS-42098: Use KubeClientCABundle for HostedClusterConfigOperator cluster-signer-ca #4736
chore(deps): update konflux references to 5ac9b24 (release-4.17) #4780
OCPBUGS-41552: Let payload generation pick the release for the NodePool #4691
chore(deps): update konflux references to 2c3426a (release-4.17) #4774
NO-JIRA: chore(deps): update konflux references (release-4.17) #4761
NO-JIRA: Security fixes for openshift-ci-security job #4748
NO-JIRA: chore(deps): update konflux references (release-4.17) #4726
HOSTEDCP-1953: bump CCO version #4694
NO-JIRA: chore(deps): update konflux references (release-4.17) #4682
OCPBUGS-41371: CPO oauth idp converter: resolve names before dialing #4681
OCPBUGS-38637: Use http dialer when dialing through proxy #4680
OSASINFRA-3572, OSASINFRA-3573: OpenStack backports for ingress #4644
OCPBUGS-39365: Update CSO deployment file #4655
OCPBUGS-39452: Fix multi-arch validation by prioritizing ReleaseImage check #4665
OCPBUGS-39419: handle version skewed NodePools that do not have rhel9 binaries #4662
OCPBUGS-39371: Fixed NodePool version validation #4657
OCPBUGS-39234: Set Image as mutable and trigger upgrades on Azure NodePool spec changes #4640
HOSTEDCP-1938: Remove saas template in 4.17 #4645
OCPBUGS-39225: copy image-registry AdditionalTrustedCA configmap into HC openshift-config #4637
OCPBUGS-39159: regroup KAS certs into public and private certs #4634
OCPBUGS-39102: Add networking-console-plugin image to CNO as an env var #4592
NO-JIRA: chore(deps): update konflux references (release-4.17) #4601
OCPBUGS-38967: [release-4.17] Remove go workspaces #4620
OCPBUGS-38941: copy oapi ca-trust recursively when building trust anchor #4614
HOSTEDCP-1861: cpo: separate KAS cert into internal and external #4595
OCPBUGS-38833: [Azure] Use infraID from infra-json if provided #4590
NO-JIRA: Fix KubeVirtNodesLiveMigratable condition for NodePools with 0 replicas #4588
HOSTEDCP-1764: retrieve registryOverrides when ImageStream is not ava… #4540
NO-JIRA: Update quay.io/openshift/origin-base Docker tag to v4.16 (release-4.17) #4573
NO-JIRA: Update golang Docker tag to v1.23 (release-4.17) #4571
NO-JIRA: Update Konflux references (release-4.17) #4570
OCPBUGS-38410: bump CPO base image to use 4.17:base-rhel9 #4544
OCPBUGS-38637: HTTPS proxy: do not proxy communication to cloud providers #4577
HOSTEDCP-1609: Support configuring Azure diagnostics via CLI flags #4555
OCPBUGS-38438: release-4.17 should not build main HO #4550
CNV-42532: KubeVirt: add label to DataVolume #4509
OCPBUGS-38183: make use of azure-disk-driver-control-plane-image #4514
OSASINFRA-3546: docs/openstack: fix typo #4510
OCPBUGS-25937: Support KMS v2 on AWS #4502
OSASINFRA-3555: openstack: e2e adjustments #4492
HOSTEDCP-1776: Set KCM node monitor grace period #4404
HOSTEDCP-1853: Add Arm NodePool Support Through Azure Marketplace #4455
OCPBUGS-38041: test: e2e: handle 409 conflict in EnsureHostedClusterImmutability #4493
HOSTEDCP-1850: Allow setting Kube APIServer maximum requests in flight #4488
OSASINFRA-3550: openstack: ingress API & octavia ingress provider #4474
OCPBUGS-37488: CSO: add environment variable for tools image #4483
NO-JIRA: Update Konflux 4.17 and perform migration #4486
NO-JIRA: Update Konflux and perform migration #4485
OSASINFRA-3554: OpenStack: Use external network ID in favor of Name #4477
OCPBUGS-37934: Reverting ETCD cluster rebuild #4475
OCPBUGS-37052: Use konnectivity HTTP proxy for ingress controller #4456
HOSTEDCP-1669: Add first azure services validation #4466
NO-JIRA: Remove non relevant OVNSbDb service type declarations #4465
HOSTEDCP-1565: add VPC Endpoint Service proxy support #4470
OCPBUGS-37832: set proxy envvars on aws and azure CCMs #4468
HOSTEDCP-1851: Use a multi-arch haproxy image for shared ingress #4454
HOSTEDCP-1669: Make hostedcluster.spec.services immutable for non IBM platforms #4449
NO-JIRA: Ensure VolumeSnapshots are deleted during cloud resource cleanup #4306
OCPBUGS-37753: Let the CPO oidc check resolve through data plane #4273
NO-JIRA: Update IBM go sdk #4435
NO-JIRA: Flaky cert validation test #4448
CNF-12681: Added support for performance profile status #4020
HOSTEDCP-1778: Default multi-arch flag to true and default release stream for HCP CLI #4447
OCPBUGS-36932: Add HTTP konnectivity proxy to OAuth server #4381
OSASINFRA-3550: docs/openstack: adds content for Ingress with MetalLB #4439
OCPBUGS-37703: fix release stream flag/rhcos image for create cluste… #4445
CNV-32074: Add Kubevirt live-migratable condition for HC and NP #4361
OCPBUGS-37698: mce-2.7 enablement for main #4442
OCPBUGS-36689: Omit the unused 0000_50_olm_06-psm-operator.service.ya… #4348
OSASINFRA-3546: openstack: document how to create a cluster #4414
NO-JIRA: chore(deps): update konflux references (main) #4426
HOSTEDCP-1798: Update AWS multi-arch docs to include migration #4421
OCPBUGS-37625: DedicatedRequestServing scheduler: make taken labels list consistent #4425
OCPBUGS-37486: Set right endpointSlice port #4422
OCPBUGS-24400: Only recreate etcd if hasn’t ever been ready #4419
OSASINFRA-3319: implements required OpenStack credentials #4410
HOSTEDCP-1791: dont render any secrets in manifest file #4420
HOSTEDCP-1798: Refactor multi-arch validation algorithm #4405
OSASINFRA-3538: openstack: small fixes for CLI #4415
OCPBUGS-34820: Keep in sync the HC and HCP ICS field #4412
HOSTEDCP-1813: Moves MachineIdentity from the HostedCluster API to the NodePool API #4408
HOSTEDCP-1791: dont render cloud-credentials secret #4406
OSASINFRA-3312: Implements OpenStack Node pools #4409
OSASINFRA-3539: Add ipam to cluster-api assets #4399
OSASINFRA-3538: openstack: cluster CLI #4396
HOSTEDCP-1838: Migrate buildah config in tekton files for migration from 0.1 to 0.2 #4403
HOSTEDCP-1836: Fix Snyk vulnerability with python deps #4394
OCPBUGS-36897: fix(api): Nodepool CEL validation fix #4378
OSASINFRA-3311: openstack: CAPO provider deployment #4373
OCPBUGS-37222: extract rhel9 MCO binaries for rhel8 based MCO images #4382
HOSTEDCP-1834: Fix Dependabot Issue By Updating Azure RHCOS Image Copy Process #4379
OCPBUGS-37102: Separate ibmcloud kms encryption configuration types #4372
NO-JIRA: Fix OADP backup objects #4376
HOSTEDCP-1832: Document konnectivity in HyperShift #4374
CNV-39630: Add ability to set tolerations on the HostedCluster #4339
OSASINFRA-3525: Initial PR to start supporting OpenStack platform #4350
CNF-11845: nodepoolcontroller: mirror containerruntimeconfig to HCP NS #4150
HOSTEDCP-1795, HOSTEDCP-1796: Customize the self-generated cert validity and rotation #4335
OCPBUGS-34816: Fix the resource from is checking the MHC platform #4365
HOSTEDCP-1820: Add snyk helper scripts to contrib #4359
NO-JIRA: Update Konflux references #4362
OCPBUGS-35899: Doubled machineHealthCheck timeout on Agent and None #4345
OCPBUGS-24400: Recreate the ETCD statefulSet on HostedCluster deployment when stays failing #4354
OCPBUGS-35905: E2E test to verify openshift-apiserver TLS certificates #4322
OSASINFRA-3310: Adds cluster-api-provider-openstack assets #4355
HOSTEDCP-1734, HOSTEDCP-1737: use proxy-protocol-v2 for shared ingress #4330
NO-JIRA: Let cmd unit tests run without a running Kubernetes cluster #4310
NO-JIRA: Default azure to run as managed-service=aro #4316
OCPBUGS-34865: Fix name resolution for HTTPS konnectivity proxy #4351
NO-JIRA: add ignition payload inspect docs #4346
OCPBUGS-33934: Add newline after TLS certs referenced by image.config #4343
NO-JIRA: Update catalog annotation based on an OCP version #4344
HOSTEDCP-1818: fix(build): update to the fixed clamav image #4342
OCPBUGS-36681: Set Azure VM identity if user assigned identity set #4332
HOSTEDCP-1716: When running the HO locally it should no required a running pod #4268
CNF-12951: hypershift:performanceprofile: associate profile name with user input #4108
NO-JIRA: Add net policy to allow ingress from sharedingress namespace #4336
OCPBUGS-34865: Add HTTP(s) konnectivity proxy for openshift-apiserver #4218
OCPBUGS-34820: Delete IDMS in dataplane once HCP ICS field is removed #4333
NO-JIRA: KubeVirtJsonPatchTest: fix vmi slice assignment #4319
NO-JIRA: Update ci image of capk to 4.17 #4183
NO-JIRA: Dump capz azure resources #4329
NO-JIRA: Remove Steve Kuznetsov from approvers/owners #4334
NO-JIRA: Update Konflux references #4324
NO-JIRA: Update AKS contrib docs #4314
HOSTEDCP-1808: Update Mkdocs, dependencies and dockerfile #4323
NO-JIRA: Dump sharedingress manifest #4321
NO-JIRA: Enhance aks docs #4311
NO-JIRA: e2e tests: skip checking ValidKubeVirtInfraNetworkMTU if no workers #4313
Revert “HOSTEDCP-1778: Enable MultiArch flag by default” #4312
NO-JIRA: skip validate metrics on azure e2e #4305
NO-JIRA: skip multiarch test before HC creation #4292
OCPBUGS-30986: remove weak ciphers from security profile #4294
NO-JIRA: Add release notes to commit and print proper output when release errors #4304
HOSTEDCP-1778: Enable MultiArch flag by default #4272
CNV-39589: [Kubevirt] Add support for passing GPU devices to NodePools #4101
NO-JIRA: chore(deps): update squidfunk/mkdocs-material docker tag to v8.5.11 - abandoned #4300
NO-JIRA: chore(deps): update konflux references #4297
OCPBUGS-23922: hcco: reconcile apiserver config into hosted cluster #4278
OCPBUGS-36230: Use a reconciled proxy config when generating nodepool userdata #4277
OCPBUGS-35521: Move infra-volumesnapshot-class-mapping to core binding #4290
OCPBUGS-33060: enable audit log for oauth-openshift #3994
NO-JIRA: test/e2e: remove api budget checks #4286
NO-JIRA: fixup azure aks docs #4293
NO-JIRA: Update HC on AKS doc for new flags for infra #4274
HOSTEDCP-1342: Add new metrics to check CA bundle validity and expiry [OSD-15414] #3442
NO-JIRA: cmd/cluster/kubevirt: add a test from dvossel #4220
HOSTEDCP-1709, HOSTEDCP-1777: test/e2e: complete move to eventually blocks #4263
OCPBUGS-36188: kubevirt-csi-driver: Pass infra kubeconfig in case of external infra #4271
OCPBUGS-31840: Make guest cluster components use the correct KAS port #3849
HOSTEDCP-1447: test/e2e: tar.gz hosted cluster content #4256
Update Konflux references #4258
OCPBUGS-35979: Keep old user data for aws < 4.16 #4269
NO-JIRA: Fix the getting started page by adding export to BUCKET_NAME #4207
HOSTEDCP-1221: add heterogenous NP e2e #4005
OCPBUGS-35874: check mgmt cluster for route capability before DeleteIfNeeded for ovn sbdb route #4254
HOSTEDCP-1709: test/e2e: actually wait for guest cluster client #4262
NO-JIRA: OWNERS: add stevekuznetsov #4255
HOSTEDCP-1709: test/e2e: use the eventually abstraction in chaos test #4247
HOSTEDCP-1709: test/e2e: updates to the eventually construct #4253
HOSTEDCP-1684: remove CLI requirement for RG flag when NSG ID is supp… #4232
CNV-30445: KubeVirt: Enable multiqueue by default #4221
NO-JIRA: chore(deps): update konflux references #4249
HOSTEDCP-1729: Support for on-demand global routing when creating transit gateway #4081
NO-JIRA: test/e2e: reduce logging for ssh and oc adm inspect #4242
NO-JIRA: test/e2e: reduce logging on guest cluster infra cleanup #4239
NO-JIRA: remove CI_TESTS_RUNS from e2e script as we now directly pass… #4226
OCPBUGS-35450: Remove KMS V1 provider support for IBM Cloud #4215
NO-JIRA: chore(deps): update konflux references to ff44cf3 #4244
HOSTEDCP-1709: test/e2e: add a harness for asynchronous assertions #4206
NO-JIRA: test: e2e: bump CPO mutate budget #4237
OCPBUGS-34544: Disable PersistentVolumeLabel admission plugin #4107
NO-JIRA: Shared ingress tests #4229
NO-JIRA: Bump golang.org/x/net from 0.20.0 to 0.23.0 in /contrib/aws-tag-lb-service-webhook #3914
NO-JIRA: chore(deps): update konflux references to 2be7c9c (main) #4222
NO-JIRA: Revert “kubevirt, e2e: Skip advanced multinet for CI” #4203
OCPBUGS-35513: cluster/core: fix nodepool naming #4219
OCPBUGS-33428: Complete KAS migration to none endpoint reconciler type #4133
CNV-42626: Transition kubevirt vms to use topology spread constraints #4145
NO-JIRA: Fix tests to avoid race conditions #4214
HOSTEDCP-1542: cmd: use validated and completed opts pattern #4212
NO-JIRA: feat(olm): Set packageserver replicas to 2 for IBMCloudPlatform #4184
NO-JIRA: Added markdown for storage table support #4213
HOSTEDCP-1542: Fixed infra-id not being defaulted first #4210
HOSTEDCP-1721: Enable shared ingress for Azure #4188
HOSTEDCP-1542: cmd/cluster: refactor to remove example fixtures #4018
HOSTEDCP-1402: cmd/infra/aws/destroy: allow using component credentials #3975
HOSTEDCP-1446: hack: remove old arguments and scripts #4186
OCPBUGS-34650: Allow specifying the volume detach timeout for machines via NodePools #4136
HOSTEDCP-1709: test/e2e: misc context fixes: #4172
IR-471: registry operator: Add missing env var, wait for rbac #4123
HOSTEDCP-1514: support Azure diagnostics on NodePools #3970
OCPBUGS-34807: Fixed ValidReleaseInfo condition #4129
OCPBUGS-33951: Documentation for disconnected MGMT Cluster #4182
kubevirt, e2e: Skip advanced multinet for CI #4187
OCPBUGS-35205: Add hypershift-cluster-version-operator image to release providers #4138
chore(deps): update konflux references #4165
HOSTEDCP-1446: hack: make the e2e script generic #4176
NO-JIRA: Delete references to the openshift-sdn image in CNO #4164
HOSTEDCP-1709: test/e2e: always bound assertions in time #4170
HOSTEDCP-1712: Initialize infra id for e2e-azure tests #4163
OCPBUGS-34274: Generate default worker security group rules based on machineCIDR #4085
NO-JIRA: test/e2e: remove dead code #4171
HOSTEDCP-1709: hack/test: remove timeouts #4169
OCPBUGS-34987: Add missing Tag permissions to cli role #4166
HOSTEDCP-1553: Add annotation to customize log verbosity of kube-apiserver #4026
HOSTEDCP-1689: add PodMonitor for external-dns #4147
OCPBUGS-33953: Document how ICSP/IDMS work in HCP #4098
OCPBUGS-33952: Documented HCP service exposure #4086
NO-JIRA: Dependabot updates #4152
HOSTEDCP-1709: test/e2e: constrain actions to context, timeout #4142
HOSTEDCP-1709: e2e/util: improve logging during node readiness poll #4153
OCPBUGS-34607: Disable machine pool feature gate #4109
HOSTEDCP-1694: Automate HO Deployment Tag & Commit Updates for ROSA HCP #4102
OCPBUGS-32467: nodepool_controller: add a reconciler for cleanup #3969
OCPBUGS-34699: Allow access to root-ca configmap in cluster-network-operator role #4122
HOSTEDCP-1542: cmd: add an option to render into a file, use it in e2e #4036
OCPBUGS-33724: Fixes update issue with KubeVirt platform #4039
HOSTEDCP-1564: Ensure VNET, NSG, & Managed RG locations match #4071
HOSTEDCP-1687: Allow arm64 baremetal nodes to a nodepool in a multi-arch cluster #4060
NO-JIRA: test/e2e: don’t validate metrics after failure #4143
OCPBUGS-32186: cmd: report server version, supported OCP #3987
NO-JIRA: Add link to agent heterogeneous nodepools doc #4135
OCPBUGS-34734: Fix disconnected metadata inspection for nodepool #4130
HOSTEDCP-1697: Allow overriding hosted cluster size label #4121
OCPBUGS-18711: add AWS STS URL to OIDC provider audiences #4094
HOSTEDCP-1558: use openshift/api instead of thirdparty for machineconfig #3983
OCPBUGS-34741: Fix fleet manager pair label check #4132
HOSTEDCP-1683: Use go workspaces #3980
OCPBUGS-31568: Prevent hypershift install render –template and –outputs from being used together #3824
NO-JIRA: chore(deps): update rhtap references #4118
NO-JIRA: Update RHTAP references #4113
HOSTEDCP-1688: Use operator namespace for openshift-config-managed-trusted-ca-bundle #4088
HOSTEDCP-1570: remove liveness and readiness probes using metrics endpoint #4001
OCPBUGS-33987: Use configmaps to track hosted cluster pair labels and set controller concurrency #4103
MULTIARCH-4668: Add how to doc for heterogeneous node pools on Agent platform #3991
OCPBUGS-34540: Fix RegistryMirrorProvider modifying the cached image directly #4100
TRT-1685: bump openshift/api #4095
OCPBUGS-33428: Reconcile KAS endpoints and endpoint slice #3942
OCPBUGS-33181: Fixed audit-logs sigterm failing to terminate gracefully #3972
OCPBUGS-31446: Add TrustedBundles to OAS container #4031
NO-JIRA: Align kv min version to the default min version (now that default is >= 4.14 #4083
OCPBUGS-30986: remove weak cipher #3855
OCPBUGS-34071: Do not scale down legacy nodes #4076
NO-JIRA: test: relax mgmt KAS egress check #4082
HOSTEDCP-1681: Skip konflux when not necessary #4080
OCPBUGS-33977: Allow specifying machine health check timeout in cluster sizing config #4075
OCPBUGS-34095: Sync the autoscaler periodically #4074
OCPBUGS-25758: fix router on 4.14 y-stream upgrade #4033
NO-JIRA: Reinstate wrongly removed fields from cert rotation objects #4070
OCPBUGS-34019: Make active & backup Azure KMS containers use different –metrics-addr #4066
OCPBUGS-33742: setting higher priority class for external-dns pods #4050
OCPBUGS-32257: Fix userReleaseProvider not using icsp/idms from mgmt cluster #4043
CNF-12792: nto: add configmaps/finalizers under operator Role #3992
CNV-40881: kubevirt, e2e, add test for advanced multinet #3902
OCPBUGS-33377: Modify token secret MCS hash in place #4057
chore(deps): update rhtap references #4063
HOSTEDCP-1556: Support Priority based expander for cluster-autoscaler #4029
NO-JIRA: Bump library-go dependency and bump LatestSupportedVersion to 4.17.0 #4044
OCPBUGS-33726: Remove service-ca annotation from azure csi & file controller metrics services #4035
OCPBUGS-33802: don’t delay new cluster creation #4045
TRT-1672: e2e: proceed with teardown even if dump fails #4051
OCPBUGS-33659: Improve resliency of size tagging when hostedcluster KAS down #4034
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

ibm-cloud-controller-manager

OCPBUGS-120696: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #115
NO-JIRA: Update OWNERS #72
OCPCLOUD-2604: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.30 (b05e0d9) into master #68
OCPBUGS-34186: Updating ose-ibm-cloud-controller-manager-container image to be consistent with ART for 4.17 #70
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80105: Bump google.golang.org/grpc to v1.79.3 #144
OCPBUGS-77209: [release-4.17] standardize build paths #123
OCPBUGS-58740: bump github.com/golang/glog to version v1.2.4 #105
OCPBUGS-56062: tech debt: rework vendor patches #90
append .0 to go.mod version #100
OCPBUGS-53911: bump github.com/golang-jwt/jwt/v4 to v4.5.2 #83
STOR-1589: Rebase to upstream 5.2.8 for OCP 4.17 #70
OCPBUGS-34162: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 4.17 #68
OCPBUGS-36074: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #69
OCPBUGS-34162: Updating ose-ibm-vpc-block-csi-driver-container image to be consistent with ART for 4.17 #67
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-103222: Use patched x/net fork v0.35.0-sec.4 #188
OCPBUGS-58435: [IBM VPC] set offlineExpansion to false in e2e test manifest #146
OCPBUGS-42277: Reorder static resources to create RBAC first #128
STOR-1596: Bump all deps for 4.17 #125
OCPBUGS-36074: CVE-2024-6104: bump github.com/hashicorp/go-retryablehttp to v0.7.7 #119
OCPBUGS-34453: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.17 #118
OCPBUGS-34224: Updating ose-ibm-vpc-block-csi-driver-operator-container image to be consistent with ART for 4.17 #117
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-86974: Updating ose-ibmcloud-cluster-api-controllers-container image to be consistent with ART for 4.17 #155
OCPBUGS-103234: Replace golang.org/x/net with openshift-sustaining/net #171
OCPBUGS-115543: Fetch envtest assets from the controller-tools releases #182
OCPBUGS-67287: [release-4.17] Fix incomplete vendor/ #139
OCPBUGS-51823: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #121
OCPBUGS-50566: Fix for CVE-2024-45338 in golang.org/x/net/html in release-4.17 #101
OCPBUGS-44880: Fetch service instance id from spec of IBMPowerVSCluster object while setting provider id #94
OCPBUGS-37369: UPSTREAM: <carry>: Fix go-retryablehttp CVE - 4.17 #86
NO-JIRA: Update OWNERS #83
OCPCLOUD-2624: Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.8.0 (8cd12b5) into main #82
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103227: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #105
NO-JIRA: vendor golint instead of relying on the CI build root #114
OCPBUGS-81667: bump vpc go sdk #92
NO-JIRA: Modernize test infrastructure to align with other MAPI providers #88
OCPBUGS-52957: IBMCloud: MAPI replacing unhealthy CP nodes #63
OCPBUGS-37379: Bump dependency for CVE #49
OCPCLOUD-2565: Adds –feature-gates CLI argument #43
OCPBUGS-36185: IBMCloud: Handle pagination for subnets #41
NO-JIRA: Update OWNERS #40
OCPCLOUD-2612: Update kube deps to 1.30 #38
OCPBUGS-34341: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.17 #37
Full changelog

insights-operator

OCPBUGS-103241: Bump golang.org/x/net to v0.35.0-sec.3 #1356
OCPBUGS-80108: Bump google.golang.org/grpc to v1.79.3 #1284
OCPBUGS-68193: OCPBUGS-68194: [vuln] Update logrus library to 1.9.3 #1227
OCPBUGS-67008: Add filtering to add other possible pod status to QEMU gatherer #1196
OCPBUGS-66395: QEMU logs are not gathered if there are pending status virt-launcher pods #1194
OCPBUGS-66394: [bugfix] The archive’s records may include files whose names are out of bounds #1193
OCPBUGS-64629: add permissions to gather clusterrole #1170
OCPBUGS-63500: add missing permissions for replicasets and events #1165
AUTH-482: set required-scc for dataGahtering jobs & pods #1049
And 34 elided commits (e.g. from squash or rebase merges)
Full changelog

ironic

OCPBUGS-88474: Update the commit hash for openstack-ironic that addresses CVE-2026-43003 #905
OCPBUGS-100163: Update openstack-ironic commit hash for CVE-2026-44918 #902
OCPBUGS-76458: Bump pyasn1 to 0.5.1-4 #827
OCPBUGS-74114: Bump keystonemiddleware version to 10.7.1-0.20260216144200.4c001ba for CVE-2026-22797 fix #796
OCPBUGS-69792: Bump eventlet version to 0.33.1-7 #761
METAL-1305: Do not use openstack packages #647
OCPBUGS-52292: Fix runlogwatch script #643
OCPBUGS-50673: Install python3-inotify pkg explicitly #640
OCPBUGS-49998: Fix runlogwatch failure if LOG_DIR does not exist #637
OCPBUGS-49822: Drop quiet option of grep to avoid race condition with pipefail #633
OCPBUGS-49756: Use pynotify instead of inotify-tools #631
OCPBUGS-48149: Bump jinja2 to 3.1.5 #622
OCPBUGS-43955, OCPBUGS-43963: Bump python-waitress [4.17] #603
OCPBUGS-42692: Include fixes for CVE-2024-5569 #590
OCPBUGS-42509: Include fix for CVE-2024-47211 #593
OCPBUGS-41783: Set node “alive” when inspection finished #578
OCPBUGS-39380: Include fixes for CVE-2024-44082 into 4.17 #576
OCPBUGS-37365: Update log statement to avoid logging entire node object #573
OCPBUGS-38511: set min version for python3-webob #552
OCPBUGS-38784: Update sushy to include Huwaei Fix ( Duplicate PR ) #572
OCPBUGS-39013: Bump ironic-lib to fix utf8 decoding issue #568
NO-ISSUE: fix scos and fcos dockerfiles to remove ironic-inspector #567
OCPBUGS-38465: update sushy to pick up the RAID fix #545
OCPBUGS-38481: Update root image #546
OCPBUGS-37402: bump werkzeug #533
METAL-1094: Sync with upstream metal3-io/ironic-image #532
OCPBUGS-37084: Update ironic projects to latest available #522
METAL-1070: Align ironic dependencies with latest upper constraints #520
OCPBUGS-33335: Update Python Jinja2 #519
METAL-1049: Download and install sources from local dir #494
OCPBUGS-32261: Update ironic-inspector to fix the memory leak #516
NO-ISSUE: Bump ironic projects versions #514
OCPBUGS-29687: Read ironic and inspector htpasswds from files #513
Bug OCPBUGS-34534: Disable installation of .pyc files through pip #508
METAL-882: Update dependency versions for OCP 4.17 #505
OCPBUGS-33902: Updating ironic-container image to be consistent with ART for 4.17 #501
Full changelog

ironic-agent

OCPBUGS-88474: Update commit hash for openstack-ironic-python-agent that addresses CVE-2026-43003 #315
OCPBUGS-99886: Bump ironic-python-agent pinned commit for CVE-2026-66138 #309
OCPBUGS-95067: Replace individual package removal with a single rpm -e loop #287
OCPBUGS-95067: Replace dnf remove with rpm -e to prevent dependency removal #275
OCPBUGS-69775: Bump eventlet version to 0.33.1-7 #231
OCPBUGS-62490: netutils: Use ethtool ioctl to get permanent mac address #214
OCPBUGS-55680: Delay determining the hostname to put into ignition #185
METAL-1305: Do not use openstack packages #179
OCPBUGS-39013: Bump ironic-lib to fix utf8 decoding issue #155
OCPBUGS-39380: Include fixes for CVE-2024-44082 into 4.17 #160
OCPBUGS-38511: set webob and bump werkzeug #148
OCPBUGS-38481: Update root image #145
METAL-1049: Download and install sources from local dir #142
OCPBUGS-37086: Update ironic projects to latest available #141
METAL-1070: Align ironic dependencies with latest upper constraints #140
OCPBUGS-35968: Disable installation of .pyc files through pip #139
NO-ISSUE: Bump ironic projects versions #137
NO-ISSUE: Replace README with an explanation how this agent works #138
OCPBUGS-33888: Updating ironic-agent-container image to be consistent with ART for 4.17 #134
Full changelog

ironic-machine-os-downloader

append .0 to go.mod version #104
OCPBUGS-33892: Updating ironic-rhcos-downloader-container image to be consistent with ART for 4.17 #98
Full changelog

ironic-static-ip-manager

OCPBUGS-49350: Fix subnet validation #47
OCPBUGS-33907: Updating ironic-static-ip-manager-container image to be consistent with ART for 4.17 #43
Full changelog

keepalived-ipfailover

OCPBUGS-34348: Updating openshift-enterprise-keepalived-ipfailover-container image to be consistent with ART for 4.17 #186
OKD-219: add util-linux to base image #187
OCPBUGS-34152: Updating openshift-enterprise-egress-router-container image to be consistent with ART for 4.17 #184
OCPBUGS-34338: Updating ose-egress-http-proxy-container image to be consistent with ART for 4.17 #185
OCPBUGS-34103: Updating openshift-enterprise-egress-dns-proxy-container image to be consistent with ART for 4.17 #183
OCPBUGS-33909: Updating openshift-enterprise-base-container image to be consistent with ART for 4.17 #182
OCPBUGS-33908: Updating openshift-enterprise-base-rhel9-container image to be consistent with ART for 4.17 #181
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #89
OCPBUGS-80013: Bump google.golang.org/grpc to v1.79.3 #65
append .0 to go.mod version #43
: OCPBUGS-46491: Disable HTTP2 #40
OCPBUGS-41580: Wire server run options to flags. #35
OCPBUGS-34258: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.17 #29
OCPBUGS-34258: Updating ose-kube-metrics-server-container image to be consistent with ART for 4.17 #28
Full changelog

kube-proxy

OCPBUGS-68165: deps: Update library-go to fix a CVE #661
OCPBUGS-43807: Revendor to a patched k/k with our prefer-local-DNS hack #640
SDN-4925: Revendor k/k to upstream 1.30.3 (for kube-proxy) #630
OCPBUGS-34279: ART sync and golang 1.22 update #629
OCPBUGS-34279: Updating kube-proxy-container image to be consistent with ART for 4.17 #623
OCPBUGS-26084: Fix scan issue #622
Full changelog

kube-rbac-proxy

ART-13124: Update go.mod to include patch version in go directive #120
OCPBUGS-42697: protobuf bump [4.17] #112
OCPBUGS-34057: Updating kube-rbac-proxy-container image to be consistent with ART for 4.17 #99
Full changelog

kube-state-metrics

OCPBUGS-103237: Use patched x/net fork v0.35.0-sec.4 #163
NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #186
OCPBUGS-74874: Deduplicate CRS stores #132
OCPBUGS-33620: [bot] Bump openshift/kube-state-metrics to v2.13.0 #115
OCPBUGS-34202: Updating kube-state-metrics-container image to be consistent with ART for 4.17 #113
OCPBUGS-34202: Updating kube-state-metrics-container image to be consistent with ART for 4.17 #112
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-17). #226
ART-13124: Update go.mod to include patch version in go directive #217
OCPBUGS-34066: Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 4.17 #205
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95083: OWNERS: Update component to Cloud Compute / KubeVirt Provider #79
OCPBUGS-34447: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.17 #44
OCPBUGS-34157: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.17 #43
Full changelog

kubevirt-csi-driver

OCPBUGS-80014: Bump google.golang.org/grpc to v1.79.3 #102
OCPBUGS-54631: Ensure volume stays attached through reboots #56
OCPBUGS-44623: During detach don’t return error if VM is not found #50
CNV-45886: Add csi-clone support to kubevirt-csi (#118) #45
CNV-44899: Sync upstream 2024-07-22 #44
OCPBUGS-35093: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.17 #43
OCPBUGS-34058: Updating ose-kubevirt-csi-driver-container image to be consistent with ART for 4.17 #41
Full changelog

libvirt-machine-controllers

OCPBUGS-77195: Fix incomplete vendor/ #301
Full changelog

machine-api-operator

OCPBUGS-103256: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1546
OCPBUGS-79373: [release-4.17] Use resource group when generating default Azure image #1481
OCPBUGS-57073: Updates GCP CredentialsRequest #1377
OCPBUGS-53036, OCPBUGS-53037: Updates GCP credentials request #1345
OCPBUGS-52576: add image/read permissions #1344
OCPBUGS-52359: Remove unneeded VNet permissions from Azure CredentialsRequest #1337
OCPBUGS-51370: Drop oVirt support #1334
OCPBUGS-43851: vSphere klog initialization preventing verbose log messages #1302
OCPBUGS-42414: Ensure deletion annotation takes priority and oldestPolicy can distinguish longer ages #1293
OCPBUGS-38868: Updates message verbs to use %q where appropriate #1278
OCPCLOUD-2565: Machineset feature gating #1273
OCPBUGS-37154: Added Permisions for Azure Capacity Reservation #1272
OCPCLOUD-2565: Updates vsphere feature gates #1269
CORS-3546: Nutanix: add gpus and dataDisks support #1266
CORS-3580: Add the hyperdisk-balanced disk type #1268
OCPBUGS-36469: Update validation for placementGroupPartition to honour it as pointer #1267
CFE-1065: Add range validation for placementGroupPartition #1265
CFE-1065: Add support for PlacementGroupPartition of placement group #1242
NO-JIRA: Update OWNERS #1264
OCPBUGS-1735: Vsphere: Handle cloned instance with lost taskID #1223
OCPCLOUD-2565: Bump openshift/api #1256
OCPCLOUD-2610: Update to Kube 1.30 deps #1255
SPLAT-1638: Added multi vCenter support #1241
CFE-1051: Adding validation for Azure capacityReservationGroupID #1250
OCPBUGS-34450: Updating ose-machine-api-operator-container image to be consistent with ART for 4.17 #1251
SPLAT-1415: Remove Alibaba #1200
https://issues.redhat.com/browse/OCPBUGS-34391: Revert #1234 “CFE-1051: Add the webhook validation for \“CapacityReservationGroupID\” to \“AzureMachineProviderSpec\” in openshift/machine-api-operator” #1246
CFE-1051: Add the webhook validation for “CapacityReservationGroupID” to “AzureMachineProviderSpec” in openshift/machine-api-operator #1234
OCPBUGS-34182: Updating ose-machine-api-operator-container image to be consistent with ART for 4.17 #1244
Full changelog

machine-config-operator

OCPBUGS-103252: Use patched x/net fork v0.35.0-sec.4 #6578
OCPBUGS-98583: Remove sensitive ControllerConfig logging #6300
OCPBUGS-97845: Bootstrap MCS logging entire ignition #6274
OCPBUGS-74149: enable nodeip-configuration for platform external #5577
OCPBUGS-77979: hermetic 4.17 #5733
OCPBUGS-77889: reduce MCO image size #5746
OCPBUGS-77812: mcd_config_drift not working properly #5741
OCPBUGS-77422: Remove MCD liveness probe #5709
OCPBUGS-77242: After OCL is enabled few phases in MCN are not updating as expected #5575
OCPBUGS-77186: Machine-config controller should not log about non-existent pull-secret changes #5679
OCPBUGS-77090: machine-config-daemon: openshift: Exposure of Sensitive Data in Log Files in the Machine Configuration Daemon. [openshift-4] #5678
OCPBUGS-61190: MCO report “failed to list *v1alpha1.MachineOSConfig” when enable TechPreview after upgrading from 4.16 to 4.17 with one mcp paused #5584
OCPBUGS-60112: Enable debug logging for nodeip-configuration #5219
OCPBUGS-62170: Fix - NetworkManager restart or crash renders br-ex unusable #5355
OCPBUGS-66037: Remove –mount directives #5443
OCPBUGS-63154: [release-4.17] Networking: reset ovn-remote config and allow ovnkube controller to set it #5358
OCPBUGS-63540: Add control-plane label for master nodes on legacy clusters #5375
OCPBUGS-63364: Invalid architecture value found in annotation during 4.19 update #5368
OCPBUGS-63055: Recheck generatedByControllerVersion annotation prior to deleting a degraded MC #5346
OCPBUGS-62741: Add /etc/docker/certs.d to template #5335
OCPBUGS-62683: Add mcd_local_unsupported_packages recording rule #5327
OCPBUGS-60890: Race in configure-ovs.sh affects bonding interface configuration. #5267
OCPBUGS-61859: Override NMState service definition #5289
OCPBUGS-59930, OPNET-681: Support migration to NMState #5206
OCPBUGS-56752: Support NODEIP_HINT in IPI deployments too #5080
OCPBUGS-60704: operator: switch out VAP v1beta1 to v1 #5256
OCPBUGS-57084: scope MCD node listers to current node #5107
OCPBUGS-60239: Add workaround fix for static pod race #5231
OCPBUGS-58292: Do not set cpu system reserve below the default value #5157
OCPBUGS-58063: Update desired config in MCN on OCL update #5139
OCPBUGS-56625: Give keepalived container chroot cap #5072
OCPBUGS-58219: Boot image controller should correctly handle marketplace boot images #5151
OCPBUGS-58218: add MachineConfiguration to CO related objects #5150
OCPBUGS-57135: pkg/operator/status: Drop PoolUpdating as an Upgradeable=False condition #5111
OCPBUGS-56901: Fix dynamic-system-reserved-calc.sh when only true parameter is used #5096
OCPBUGS-56976: Boot Image Controller should not degrade when golden configmap is slow to update #5101
OCPBUGS-56990: Only update boot disks during GCP boot image updates #5102
OCPBUGS-56828: daemon: fix ostree-finalize-staged race workaround for package mode RHEL workers #5087
OCPBUGS-52313: Update machine-config-daemon-pull.service to use custom policy for Podman < 4.4.1 #4893
OCPBUGS-56665: Add hot loop detection in the boot image controller #5077
OCPBUGS-56395: error from generateAndValidateRenderedMachineConfig function can be misleading #5060
OCPBUGS-56218: Rewrote TestFirstBootHasSSHKeys e2e test in pure Go #5053
OCPBUGS-55615: MSBIC should not update windows machinesets #5021
OCPBUGS-55490: MCO should fall back to us-east-1 for AWS bootimages if no region specific-AMI exists #5020
OCPBUGS-54830: Make mtu-migration run after wait-for-primary-ip #4989
OCPBUGS-52314: on-prem/resolv-prepender: stop leaking tmp files #4894
OCPBUGS-45989: Do not run resolv-prepender from NM dispatcher #4785
OCPBUGS-52188: ignore mc not found error #4957
OCPBUGS-52951: Add ipsec connect wait service #4930
OCPBUGS-53441: Fixing typos for MachineConfigNode #4936
OCPBUGS-53186: Update ObservedGeneration in KubeletConfig #4919
OCPBUGS-53225: daemon: ensure ostree-finalize-staged is started before rebooting #4920
OCPBUGS-52160: Enforce VIPs to be collocated at the same host #4884
OCPBUGS-52303: Enable nmstate-configuration on all platforms #4891
OCPBUGS-51003: daemon: add nil check for annotation fetching #4862
OCPBUGS-51353: Update cluster-reader ClusterRole permissions #4882
OCPBUGS-50955: create /run/nodeip-configuration before use #4858
OCPBUGS-51334: Update format verbs for alert logs #4880
OCPBUGS-52257: configure-ovs workaround for ovs-if-br-ex bug #4889
OCPBUGS-49973: Update the storage.conf configuration file template #4836
OCPBUGS-49363: Auto-recover from MC with invalid extension #4824
OCPBUGS-49716: MCO CO degrades are stuck on until master pool updates complete #4826
OCPBUGS-49639: Add clarification to invalid maxUnavailable alert #4820
OCPBUGS-47475: Pausing Master MCP results in Alerts #4769
OCPBUGS-47802: OCPBUGS-47801: trying to wait for sub-controllers #4775
OCPBUGS-38292: controller: default to runc when upgrading clusters from 4.17 to 4.18 #4715
OCPBUGS-45918: Remove trailing periods from AWS provided hostnames #4738
OCPBUGS-39223: Do not enable on-prem-resolv-prepender.path for UPI #4572
OCPBUGS-38292: Revert “controller: default to runc when upgrading clusters from 4.17 to 4.18” #4716
OCPBUGS-38292: controller: default to runc when upgrading clusters from 4.17 to 4.18 #4635
OCPBUGS-44561: Disable tx chksum for driver IDPF on GCP C3/C4 #4701
MCO-1343: Backport Telemetry to 4.17 #4650
OCPBUGS-43917: Disable ESP offload for OVS attached interfaces #4667
OCPBUGS-43719: Soften haproxy timeout for kubeapi probe #4657
OCPBUGS-42577: openstack: fix non-old systemd compatible unit #4620
OCPBUGS-42108: Do not use ‘restart’ for ‘oneshot’ service #4615
OCPBUGS-42979: Regenerate the rendered MC in use when deleted #4634
OCPBUGS-42677: The MCO does not properly degrade when pools are failing to render a new config #4623
OCPBUGS-42081: Check for kernel arg diff in updateOnClusterBuild #4595
OCPBUGS-41255: Set ESP offloads off in bonds if slaves don’t support them #4598
OCPBUGS-42256: Panic seen in CI job for MCC pod #4603
OCPBUGS-42200: MCPs report wrong number of nodes when we move nodes from one custom MCP to another custom MCP #4602
OCPBUGS-41357: Enable the use of Linux Bridge as the ovs default port connection #4567
OCPBUGS-41686: MCPs with RHEL nodes are degraded when a userCA bundle is added to the cluster #4580
OCPBUGS-41802: When newly built images rolled out, the update progress is not displaying correctly (went 0 –> 3) #4583
OCPBUGS-41688: Add alert for users of deprecating the Image Registry workaround #4581
OCPBUGS-41312: CVE-2024-3727 ose-machine-config-operator-container: containers/image: digest type does not guarantee valid type #4564
OCPBUGS-38868: Updates message verbs to use %q where appropriate #4547
OCPBUGS-38770: SCC-pinning for openshift workloads #4542
OCPBUGS-38846: Machine-config daemon ListPools panic during tech-preview CI runs #4546
OCPBUGS-38415: Give keepalived-monitor necessary capabilities #4532
OCPNODE-2482: Enable CRI-O internal repair feature as the default #4535
OCPBUGS-38374: Revert “MCD-pull: run after network-online.target in Azure” #4529
OCPBUGS-38321: Revert “templates/master/cri-o: make crun as the default container runtime” #4524
OCPNODE-2357: templates/master/cri-o: make crun as the default container runtime #4518
NO-JIRA: crio: set min memory for crun #4516
OCPBUGS-35800: kubelet config controller does not always propogate tlsSecurityProfile #4512
OCPBUGS-31298: Prevent no-operation patches from overloading the kube-api server with unnecessary calls #4511
MCO-703: Lifecycle Buildah with MCO #4471
MCO-1214: Enabled boot images updates for AWS #4492
NO-ISSUE: Move ManagedBootImages and NodeDisruptionPolicy to default e2e suite #4513
NO-JIRA: Fix HasOSImage function #4510
NO-ISSUE: Remove openshift/api pin #4508
MCO-1065: MCO-1171: API bump for ManagedBootImages and NodeDisruptionPolicy GA #4496
OCPBUGS-33784: Guard MachineOSBuild informers with feature gates #4497
MCO-1230: Retry build and push operations multiple times #4469
OCPBUGS-30955: On-Prem resolv prepender to watch for NM changes #4488
MCO-1191, MCO-1194: Experiment with creating internal go bindings for bootc , Incorporate support for bootc commands to Machine Config Daemon #4465
OCPBUGS-36289: e2e test should wait for MCD pod to be running #4444
NO-ISSUE: OWNERS: keep up-to-date with active maintainers #4493
MCO-1202: MCO-1203: MCO-1204: MCO-1205: MCO-1213: Implementing tlsSecurityProfile for MCO #4435
SPLAT-1381: Remove Alibaba #4112
NO-ISSUE: API bump to fetch BootcNodeManagement FG #4487
OCPBUGS-36175: Remove privileged flag from on-prem containers #4443
OCPNODE-2438: bump API and update CRD manifests #4480
OCPBUGS-37271: kubelet: boot without PSI for performance concerns #4470
MCO-1125: OCPBUGS-35277: Allow paths to be defined for non-disruptive updates #4472
OCPBUGS-19537: OCB should fail if node is not coreos based #4442
MCO-1227: Run boot image controller only when required #4477
OCPBUGS-33397: Openshift uncordoned compute-node that was intentionally cordoned #4475
OCPBUGS-33134: Nodes are drained twice when an OCB image is applied #4467
OCPBUGS-36654: Machine-config operator should not hot loop generating ValidatingAdmissionPolicyUpdated events #4460
OPNET-465: Refactor LB and DNS manifest list for vSphere #4167
MCO-1103: Restore setup-envtest used in the verify test #4458
MCO-1144: Implement progressing/error boot images conditions on the MachineConfiguration object #4390
NO-ISSUE: Revert “disable mglru service” #4468
OCPBUGS-36344: Add CIP relevant mirrors to sigstore attachement cfg #4449
OCPBUGS-35436: Remove disable-mglru.service #4466
OCPBUGS-36711: templates: run disable-mglru conditionally #4459
OCPBUGS-35300: MCD-pull: run after network-online.target in Azure #4423
OCPBUGS-30603: Bootstrap e2e test featuregate setup does not match the actual code #4439
MCO-1147, OCPBUGS-34225: Pick up openshift/kubernetes 1.30 rebase updates, Dockerfile Update #4399
OCPNODE-2226: Introduce versioning in auto-node-sizing feature #4363
OCPBUGS-21628, OCPBUGS-28974: daemon: Handle correctly OS Version for 4.1 and 4.2 bootimages #4429
OCPBUGS-33694: daemon/update: disable systemd unit before overwriting #4421
OCPBUGS-36178: remove unnecessary e2e test TestControllerConfigStuff #4434
OCPBUGS-33913, OCPBUGS-34261: CurrentImagePullSecret should be consumed by the MCD #4395
OCPBUGS-35971: disable mglru kernel feature #4425
NO-JIRA: format policy.json #4412
OCPBUGS-32348: Make logging configurable for on-prem components #4344
OCPBUGS-31710: Unify machineconfig file format for kubeletconfig to use YAML encoding instead of JSON encoding #4350
OCPBUGS-35519: Revert “Azure: add Azure specific dnsmasq ordering” #4411
OCPBUGS-33331: Fix reference to $host_file #4353
OCPBUGS-34050: Default ipv4 NODE_IP to 0.0.0.0 #4388
OCPBUGS-35300: Azure: add Azure specific dnsmasq ordering #4404
OCPNODE-2216: crio: migrate metrics port to localhost only [4.17] #4292
OCPNODE-2336: Drop ClusterImagePolicy validation on scope conflicts with release-image repo #4401
OCPBUGS-33671, OCPBUGS-34079: fix secret canonicalization #4366
OCPBUGS-33129: Panic when we remove an OCB infra MCP and we try to create new ones with different names #4396
MCO-1152: MCO-1146: Add e2e tests for NodeDisruptionPolicy #4365
OCPBUGS-34959: ensure event handlers are registered after queue is configured #4359
OCPBUGS-29820: kubelet.service: wait for chronyd #4381
OCPBUGS-33248: daemon: upgrade os image from local container storage if it exists #4347
OCPBUGS-28653: userCA and cloudCA certfiicates are not removed from nodes and ignition config #4378
OCPBUGS-32367: The MCD can override a restart crio action with a reload crio action #4376
OCPBUGS-31312: machine-config-controller not logging enough details to triage the malformed certificate issue. #4379
OCPBUGS-32242: The MCO makes a lot of API requests for ClusterOperator objects #4321
OCPBUGS-30343: Scope each MCN object to only be accessible from its associated MCD #4346
AUTH-482: set required-scc for openshift workloads #4219
NO-ISSUE: Update baremetal owner aliases #4354
SPLAT-1554: Added featuregate for multi vCenter support. #4298
OCPBUGS-33803: machine-os-puller SA refreshes every hour, causing machine config regeneration #4370
Full changelog

machine-image-customization-controller

OCPBUGS-103246: Use patched x/net fork v0.35.0-sec.4 #192
OCPBUGS-68192: [4.17] Uplift logrus #152
append .0 to go.mod version #135
OCPBUGS-34358: Updating ose-image-customization-controller-container image to be consistent with ART for 4.17 #127
OCPBUGS-34358: Updating ose-image-customization-controller-container image to be consistent with ART for 4.17 #126
Full changelog

machine-os-images

OCPBUGS-87877: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #101
OCPBUGS-54146: Change rhcos release browser url #56
OCPBUGS-34177: Updating ose-machine-os-images-container image to be consistent with ART for 4.17 #38
Full changelog

monitoring-plugin

OCPBUGS-118233: [release-4.17] Bump fast-uri to 3.1.7 to fix CVE-2026-84292 #1336
OCPBUGS-98777: [release-4.17] replace outdated react-linkify dependency #1343
Fix for OCPBUGS-98163: CVE-2026-13676 #1050
Fix for OCPBUGS-90525 OCPBUGS-90526: CVE-2026-12151 CVE-2026-9697 #1008
OCPBUGS-79444: immutable bump #897
OU-1260: [release-4.17] feat: use npm instead of yarn #812
OCPBUGS-76809: fix for CVE-2025-69873 #848
OCPBUGS-70290: Manual cherry pick qs vulnerability 4 17 #747
OCPBUGS-64942: Use tenancy access to metric lables #639
OU-1058: Don’t show TP button in non-administrator #637
OCPBUGS-62282: align dev and admin persective tab names #602
OCPBUGS-62282: add missing translation string #587
OCPBUGS-61891: feat: add alerting rules tab to dev console #538
OCPBUGS-59399: Fix “Export as CSV” #468
OCPBUGS-54211: fix issue preventing dev silences from loading #374
OU-724: remove deleted image #377
OCPBUGS-51117: Fix overview links #357
OCPBUGS-44394: remove unused package and upgrade vulnerable dependency #271
OCPBUGS-43238: upgrade dynamic plugin sdk to remove vulnerable dependencies 4.17 #216
OCPBUGS-42408: fix path-to-regexp dependency #196
NO-JIRA: Update query-browser to not use setState #166
NO-JIRA: upgrade to go 1.22 fixing the z version #163
NO-JIRA: downgrade to go 1.21 to be able to use cachito #161
NO-JIRA: add FIPS compliant flags and env vars #159
NO-JIRA: fix cachito web folder #152
NO-JIRA: Use DNF and go based image in Dockerfile #155
NO-JIRA: fix command chain for art image #150
NO-JIRA: fix cachito pem file location #147
NO-JIRA: fix cachito target folder #145
NO-JIRA: Fix art image cachito path for yarn lock #143
OU-436: Add Golang backend #128
OU-258: Dev console: Use Metrics page from monitoring-plugin #138
OCPBUGS-37291: check undefined function before calling #137
NO-JIRA: Fix docker local and log query browser error #135
OU-248: Add Alerts Detail Page #131
OU-238: Export CSV #127
OCPBUGS-36970: Use the non-tenancy URL in the Admin perspective #134
OU-251: Prevent rule labels from being added to alert labels for dev console #132
OU-439: Add the predefined queries list to the admin metrics #129
OU-251: Migrate Developer Perspective Alert List to Monitoring Plugin #125
OKD-210: Use rhel9 base image in Dockerfile #121
OCPBUGS-34312: Updating monitoring-plugin-container image to be consistent with ART for 4.17 #120
OCPBUGS-34312: Updating monitoring-plugin-container image to be consistent with ART for 4.17 #119
Full changelog

multus-admission-controller

OCPBUGS-103264: bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 #135
OCPBUGS-58770: Update the github.com/golang/glog module to v1.2.4 #102
append .0 to go.mod version #97
OCPBUGS-34283: Updating ose-multus-admission-controller-container image to be consistent with ART for 4.17 #85
NP-1046: Update owners #86
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-103255, OCPBUGS-103257: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #358
OCPBUGS-85250: Fix server url in kubeconfig #299
NO-ISSUE: [release-4.17] Bump Go to 1.22 and fix CI build root image #290
OCPBUGS-77854: hermetic 4.17 #277
OCPBUGS-43391: Update net-attach-def client library to 1.7.5 for cri-o functionality [backport 4.17] #257
OCPBUGS-47471: adds getcontext (backport 4.17) #260
OCPBUGS-41817: always attempt a live pod get on miss to confirm its really not there #248
OCPBUGS-37991: Downstream sync to address multiple interface returns in network-status annotation #245
OKD-218: install util-linux #241
OCPBUGS-34911: Update owners file #237
OCPBUGS-33559: Thick plugin should not wait for API readiness on CNI DEL #233
Full changelog

multus-networkpolicy

append .0 to go.mod version #71
And 3 elided commits (e.g. from squash or rebase merges)
Full changelog

multus-route-override-cni

NP-1041: Update owners #57
Full changelog

multus-whereabouts-ipam-cni

OCPBUGS-73728: Update tag on ci-operator.yaml file #395
OCPBUGS-70256: Prevent accidental IP deallocation in statefulsets #393
OCPBUGS-55617: Fixes leftover podref issue #364
OCPBUGS-48745: [Release-4.17]Kubeconfig loop #334
OCPBUGS-33941: upstream sync 23072024 #303
NP-1045: Update owners #285
OCPBUGS-29648: upstream sync 13062024 #290
OCPBUGS-24663: upstream sync 2024/05/23 #284
Full changelog

must-gather

OCPBUGS-86069: Collect object size with the object count #548
OCPBUGS-60607: Separate resources with comma to fix malformed inspect #504
NO-JIRA: append .0 to go.mod version #492
OCPBUGS-48068: Update owners #452
OCPBUGS-46281: Support gathering IPsec data #467
OCPBUGS-42835: Removes reference to gather_multus_logs in 4.17 #459
OCPBUGS-42964: Collect etcd object count #453
OCPBUGS-42958: Gather OSUS data #443
OCPBUGS-42835: [Release-4.17] Network logs collection: skip unready nodes #445
CNF-13837: gather_ppc: fallback option when NTO image not found #436
MON-3108: Add gather_metrics for Prometheus fetching #434
OCPBUGS-33959, SDN-5066: Remove needless multus log collection #431
NO-JIRA: Update dockerfile rename changes #433
NO-JIRA: Rename Dockerfile #432
NO-JIRA: Correct typo. #414
NO-JIRA: Adding the missing clusterresourcequota and Flowcontrol resources #408
OCPBUGS-34360: Run ppc node collection in parallel #424
OCPBUGS-31037: Collect PerformanceProfile Data From all Nodes #410
OCPBUGS-33959: Network logs collection: skip unready nodes #425
OCPBUGS-34467: Updating ose-must-gather-container image to be consistent with ART for 4.17 #423
Full changelog

network-interface-bond-cni

OCPBUGS-77350: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.17 #110
OCPBUGS-59620: Bump github.com/containernetworking/plugins from to 1.7.1 #83
NO-JIRA: Add ci-operator file #82
OCPBUGS-34286: Updating ose-network-interface-bond-cni-container image to be consistent with ART for 4.17 #64
Full changelog

network-metrics-daemon

OCPBUGS-103254: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #154
OCPBUGS-130598: add ./bin to PATH in check_golint.sh #162
append .0 to go.mod version #105
And 6 elided commits (e.g. from squash or rebase merges)
Full changelog

network-tools

append .0 to go.mod version #148
NO-JIRA: Add real total line to the bug ranking #131
NO-JIRA: Px score for bugs #128
OCPBUGS-34469: Updating ose-network-tools-container image to be consistent with ART for 4.17 #129
NO-JIRA:In recently assigned bugs, exclude bugs we don’t count as such #127
Full changelog

nutanix-cloud-controller-manager

NO-JIRA: Update OWNERS #34
OCPCLOUD-2603: Merge https://github.com/nutanix-cloud-native/cloud-provider-nutanix:main (ab0df3a) into main #31
Full changelog

nutanix-machine-controllers

OCPBUGS-51859: CVE-2025-22868 #111
OCPBUGS-47267: fixing CVE-2024-45338 #92
OCPBUGS-55728: Fix link-local addresses being added to machine #102
CORS-3546: Nutanix: support for gpus and dataDisks #77
OCPCLOUD-2565: Adds –feature-gates CLI argument #78
OCPCLOUD-2611: Update to Kube 1.30 #75
OCPBUGS-34230: Updating ose-nutanix-machine-controllers-container image to be consistent with ART for 4.17 #74
NO-JIRA: Update OWNERS #76
Full changelog

oauth-apiserver

OCPBUGS-103267: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 #225
OCPBUGS-66228: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #157
NO-JIRA: (chore): update OWNERS file #171
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #143
append .0 to go.mod version #133
OCPBUGS-46044: Update dependencies to address CVE-2024-24786 #127
OCPBUGS-34446: Updating ose-oauth-apiserver-container image to be consistent with ART for 4.17 #116
OCPBUGS-34140: Updating ose-oauth-apiserver-container image to be consistent with ART for 4.17 #115
Full changelog

oauth-proxy

OCPBUGS-136604: [release-4.17] Sync OWNERS and OWNERS_ALIASES with master #402
OCPBUGS-112108: bugfix: rewrite open redirect strings to ‘/’ #385
OCPBUGS-61445: Update x/crypto to v0.31.0 #334
OCPBUGS-58472: fix e2e tests #327
OCPBUGS-30443: Update dependencies to address CVE-2024-24786 #298
OCPBUGS-46659: Fix oauth-proxy e2e-component tests #303
Full changelog

oauth-server

OCPBUGS-103265: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #280
OCPBUGS-87070: bugfix: default to english when Accept-Language header contains more than 1000 underscores #273
OCPBUGS-81795: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #239
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #198
append .0 to go.mod version #185
OCPBUGS-44118: escape spaces in oauth callback path #167
OCPBUGS-43587: Fix login path for go1.22 mux pattern matching #162
OCPBUGS-34248: Updating oauth-server-container image to be consistent with ART for 4.17 #149
OCPBUGS-33695: p/o/handlers - fix nil-pointer, if ResStatus is nil #150
Full changelog

oc-mirror

OCPBUGS-130910: v1 accept catalog root entries and relative symlink targets #1595
And 37 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-catalogd

NO-ISSUE: Synchronize From Upstream Repositories #59
NO-ISSUE: Synchronize From Upstream Repositories #57
NO-ISSUE: Synchronize From Upstream Repositories #53
And 5 elided commits (e.g. from squash or rebase merges)
Full changelog

olm-operator-controller

OCPBUGS-103266, OCPBUGS-103269: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #805
OCPBUGS-80129: Update grpc-go to v1.71.3-sec.1 to fix CVE-2026-33186 #736
NO-ISSUE: Synchronize From Upstream Repositories #124
NO-ISSUE: Synchronize From Upstream Repositories #123
NO-ISSUE: Synchronize From Upstream Repositories #121
NO-ISSUE: Synchronize From Upstream Repositories #119
NO-ISSUE: Synchronize From Upstream Repositories #118
NO-ISSUE: Synchronize From Upstream Repositories #117
NO-ISSUE: Synchronize From Upstream Repositories #115
OCPBUGS-36471: Synchronize From Upstream Repositories #114
NO-ISSUE: Synchronize From Upstream Repositories #111
NO-ISSUE: Synchronize From Upstream Repositories #110
NO-ISSUE: Synchronize From Upstream Repositories #109
NO-ISSUE: Synchronize From Upstream Repositories #108
NO-ISSUE: Synchronize From Upstream Repositories #107
NO-ISSUE: Synchronize From Upstream Repositories #106
NO-ISSUE: Synchronize From Upstream Repositories #104
NO-ISSUE: Synchronize From Upstream Repositories #103
And 12 elided commits (e.g. from squash or rebase merges)
Full changelog

openshift-apiserver

OCPBUGS-82720: Address CVE-2026-35469 #658
OCPBUGS-68208: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.17] #609
OCPBUGS-74143: pkg/image: conditionally parse raw image manifest #596
OCPBUGS-66229: UPSTREAM <carry>: bump kubernetes-apiserver to pick up loopback certificate expiration update #584
OCPBUGS-63392: Wire dry run option to Image API server operations #565
OCPBUGS-61584: Bump openshift/kubernetes-apiserver for etcd retry patches. #554
OCPBUGS-53382: Skip blocked registry check for registries with mirrors #500
OCPBUGS-58821: Fix image reference in TestImageStreamImportQuayIO #515
append .0 to go.mod version #525
OCPBUGS-49399: prevent panic when no image and error are set #488
OCPBUGS-49399: validate image property isn’t nil before using #489
OCPBUGS-49399: move on to the next digest/tag during failures #487
OCPBUGS-42752: Pass expected type to deploymentconfig/scale object validation. #457
OCPBUGS-42232: fail image import when both image and error are nil #450
OCPBUGS-34375: Updating ose-openshift-apiserver-container image to be consistent with ART for 4.17 #437
Full changelog

openshift-controller-manager

OCPBUGS-103272: Use patched x/net fork v0.35.0-sec.4 #456
OCPBUGS-61199: legacy image pull secret rollback controller #413
OCPBUGS-57950: ignore error failing to find pull/push secrets #400
OCPBUGS-57480: Set node-pullsecrets volume to read-only to protect image pull credentials #393
OCPBUGS-55826: Empty proxy variables are causing issues during the build #379
OCPBUGS-47769: Add team members to the OWNERS file #357
OCPBUGS-44093: user system:serviceaccount:openshift-infra:serviceaccount-pull-secrets-controller in ns/openshift-infra must not produce too many applies #350
NO-JIRA: cleanup root and app OWNERS #346
OCPBUGS-42362: Continuous pull-secret updates / slow initialization on build01 (test platform infrastructure) #339
OCPBUGS-39167: replaces deprecated square/go-jose wtih go-jose/go-jose #328
OCPBUGS-35731: Race condition when deleting ServiceAccount #318
Revert Revert OCPBUGS-36833: 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation #322
NO-JIRA: Revert “OCPBUGS-36833: 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation” #321
OCPBUGS-36833: 4.16 “Bad” reconciliation loops can cause unbounded dockercfg secret creation #319
OCPBUGS-32873: Replace deprecated gopkg.in/square/go-jose.v2 #315
OCPBUGS-12699: Whitelists lower-case proxy envs to pod proxydefaults #310
WRKLDS-1292: Bump k8s dependencies to 1.30.1 #313
OCPBUGS-33815: openshift-controller-manager overwriting/undoing changes to ServiceAccount imagePullSecrets #306
OCPBUGS-33834: filter delete events #307
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #150
append .0 to go.mod version #124
OCPBUGS-34298: Updating openshift-state-metrics-container image to be consistent with ART for 4.17 #117
OCPBUGS-34298: Updating openshift-state-metrics-container image to be consistent with ART for 4.17 #116
MON-3878: Remove deprectated logtostderr #114
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-103280: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #196
OCPBUGS-80133: Bump google.golang.org/grpc to v1.79.3 #194
NO-JIRA: Add more docs for configuration options #167
STOR-1596: Bump all deps for 4.17 #176
OCPBUGS-30949: Add config map hooks #168
OCPBUGS-34870: Correct out-of-bounds check #170
OCPBUGS-34276: Updating ose-openstack-cinder-csi-driver-operator-container image to be consistent with ART for 4.17 #169
Full changelog

openstack-cluster-api-controllers

OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #343
append .0 to go.mod version #364
OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #342
OCPBUGS-44959: Makefile changes for merge-bot #340
OCPBUGS-44455: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #329
OCPBUGS-43584: Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into release-4.17 #323
OCPBUGS-34072: Updating openstack-cluster-api-controllers-container image to be consistent with ART for 4.17 #317
Merge https://github.com/kubernetes-sigs/cluster-api-provider-openstack:release-0.10 into main #316
Remove dulek from shiftstack-team #313
NO-JIRA: Bump to latest CAPO v0.10 #314
Full changelog

openstack-machine-api-provider

OCPBUGS-78169: hermetic 4.17 #162
OCPBUGS-76793: Fix make test #160
NO-JIRA: Update shiftstack-team in OWNERS_ALIASES #118
OCPBUGS-34329: Update to Go v1.22, and OCP v4.17 and Kubernetes v1.30 #117
NO-JIRA: Remove a stray comment #113
OCPBUGS-33954: Failure to get bootstrap is non-fatal #112
OCPBUGS-33806: Fix panic deleting Machine in ERROR state #111
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103275, OCPBUGS-103278, OCPBUGS-103286: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1368
OCPBUGS-80136, OCPBUGS-80137, OCPBUGS-80138: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.71.3-sec.1 [release-4.17] #1315
OCPBUGS-77838: Remove the collect-profiles info from the microshift kustomization file #1250
OCPBUGS-76953: Remove the collect-profiles job #1232
OCPBUGS-67301: Fix TOCTOU race condition in ensureInstallPlan (#3682) #1172
OCPBUGS-57092: [release-4.17] e2e stability fixes #1081
OCPBUGS-60791: Add NetworkPolicy as a supported kind #1058
OCPBUGS-57428: reduce cache expiry frequency [release-4.19] #1021
OCPBUGS-59253: Reduce Frequency of Update Requests for Copied CSVs (#3597) #1036
OCPBUGS-57438: operatorgroup: ensure clusterroleselectors in clusterrole aggregation rules are sorted #1025
OCPBUGS-56250: fix(olm): improve error logging for missing olm.managed label (#3558) #1004
OCPBUGS-51226, OCPBUGS-51228, OCPBUGS-51246: (vendor) pin go-jose/v4@v4.0.5 #998
OCPBUGS-53071: add missing pod disruption reasons to isPodDead #982
OCPBUGS-53283: Ensure that PSA label is latest instead of pinning versions #985
OCPBUGS-50829, OCPBUGS-50831, OCPBUGS-50835: CVE-2025-24976 Bump github.com/distribution/distribution/v3 [release-4.17] #968
OCPBUGS-48695: Fix excessive catalog source snapshots cause severe performance regression #956
OCPBUGS-45845: Fix concurrent namespace resolution #944
OCPBUGS-46929, OCPBUGS-46936, OCPBUGS-47316: x/net bump to v0.34.0 [release-4.17] #938
OCPBUGS-46598: catalog-operator: Delete Pods that were evicted (#3459) #922
OCPBUGS-46054: CRD upgrade existing CR validation fix #913
OCPBUGS-44760: fix: call TokenRequest API when service account token secret is missing #898
OCPBUGS-43965: Return an error when the IP status cannot be updated #885
OCPBUGS-41549: [4.17] adds paginating lister for evaluating CRs’ upgrade fitness versus new CRDs. #860
OCPBUGS-41498: [release-4.17] Fix e2e flake: upgrade CRD with deprecated version #858
OCPBUGS-39574: (fix) registry pods do not come up again after node failure (#3366) #855
OCPBUGS-39458: add optional schema migrations; default to olm.bundle.object instead of olm.csv.metadata (#1384) #851
NO-ISSUE: Synchronize From Upstream Repositories #835
NO-ISSUE: Synchronize From Upstream Repositories #834
NO-ISSUE: Update junit report file name to show spec results on Test Grid #832
OCPBUGS-36500: remove cvo hypershift profile annotation from psm-operator manifests #831
NO-ISSUE: Synchronize From Upstream Repositories #830
NO-ISSUE: Synchronize From Upstream Repositories #827
NO-ISSUE: Synchronize From Upstream Repositories #825
NO-ISSUE: Synchronize From Upstream Repositories #820
NO-ISSUE: Synchronize From Upstream Repositories #816
OCPBUGS-35970: add io.openshift.release.operator label to image #812
NO-ISSUE: Synchronize From Upstream Repositories #815
NO-ISSUE: add output-dir to E2E_GINKGO_OPTS #813
OCPBUGS-35970: don’t erase the filesystem from the base tools image #804
NO-ISSUE: Manual Sync 0702 #808
OCPBUGS-35970: switch base image #802
NO-ISSUE: Synchronize From Upstream Repositories #801
NO-ISSUE: Synchronize From Upstream Repositories #797
NO-ISSUE: Manual Sync #796
OPRUN-3221: 🌱 fix xplat compile for of-tools image; hide utest files from git; use rhel8 art builder image #770
NO-ISSUE: Synchronize From Upstream Repositories #790
NO-ISSUE: Synchronize From Upstream Repositories #783
NO-ISSUE: Synchronize From Upstream Repositories #778
NO-ISSUE: Synchronize From Upstream Repositories #763
NO-ISSUE: (Manual) Synchronize From Upstream Repositories #758
Full changelog

operator-marketplace

OCPBUGS-68212, OCPBUGS-68213: [release-4.17] CVE-2025-65637 fixed in logrus v1.9.3+ #710
OCPBUGS-62219: Remove Expect func so that the test case can use the retry logic #670
OCPBUGS-61036: Update memoryTarget on catalog source pods #663
ART-13124: append .0 to go.mod version #638
OCPBUGS-53179: Ensure that PSA label is latest instead of pinning versions #607
OCPBUGS-49431: Upgrade golang.org/x/net [release-4.17] #585
OCPBUGS-39297: Replace 4.16 image references with 4.17 #573
NO-ISSUE: Add client certificate and key to service monitor #482
OCPBUGS-34244: Updating marketplace-operator-container image to be consistent with ART for 4.17 #568
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-128826: node: fix serviceUpdateNotNeeded nil pointer comparison #3496
OCPBUGS-82724: Bump github.com/moby/spdystream to v0.5.1 #3322
OCPBUGS-81639: External gateway: Remove routes for external gateway pods in terminating or not ready state #3107
OCPBUGS-78029: Add pperiyasamy to OWNERS for release-4.17 #3046
OCPBUGS-77568: Clear stale conntrack UDP entries for nodePorts #3035
CORENET-6055, OCPBUGS-74492: [release-4.17] Dockerfile: Unpin OVN and consume the latest from FDP #2959
[release:4.17] OCPBUGS-71985: Fix conntrack reconciliation to use service port instead of endpoint port #2936
OCPBUGS-71218: [release-4.17] CVE-2025-65637 Bump github.com/sirupsen/logrus to v1.9.1 through indirect dependency conversion (go-controller module) #2905
OCPBUGS-71198: NetPol & MultiNetPol: Process update only when spec fields and/or related annotation are updated #2923
OCPBUGS-68348: Add ricky-rav to OWNERS for release-4.17 #2898
OCPBUGS-65928: Skip Pending pods in EgressIP status #2871
OCPBUGS-65569: [release-4.17]: kubevirt: fix bad release of IPs of live migratable pods #2857
OCPBUGS-64856: Fix stale EIP assignments during failover and controller restart #2850
OCPBUGS-64674: [release-4.17]: Configure sec nic EIPv6 address with NODAD and maximum lifetime #2843
OCPBUGS-63154: Fix EgressIP stale GARP post reboot + pod restart #2807
OCPBUGS-61749: [release-4.17] Fix dnsnameresolver address set #2796
OCPBUGS-60484: Update OWNERS file: Add Patryk/Martin as approvers #2717
OCPBUGS-59381: [release-4.17] Fix default network -> localnet #2667
OCPBUGS-58160: Unpin OVS patch versions, move to ovs 3.5 #2647
OCPBUGS-57109: Fix hybrid overlay node subnets collision with cluster subnets #2620
OCPBUGS-57107: Increase InformerSyncTimeout to 60s #2623
OCPBUGS-56443: Fix predicate for cluster subnet route to gateway router #2578
OCPBUGS-56244: Allow default network pods to reach localnet on the same node #2572
OCPBUGS-52480: Handles unspecified protocol in network policy port #2478
OCPBUGS-54203: Update OVN to FDP25.A.1 24.03.5-40. #2496
OCPBUGS-52409: Change dynamic_neigh_routers to false for the Interconnect topology. #2476
OCPBUGS-50519: kubevirt, localnet: Reduce live migration downtime #2458
OCPBUGS-48777: Fixes unexpected mp0 route removal during start up #2423
OCPBUGS-48828: fixes overzealous deletion of SNAT in egressIP #2425
OCPBUGS-47506: Let OVN-northd bind remote ports #2404
OCPBUGS-45953: bump OVS version to 3.4.0-18 #2393
OCPBUGS-45312: pin libreswan to 4.6-3.el9_0.3 #2384
OCPBUGS-45339: Dockerfile: Update OVN to the 24.03.2-32.el9fdp minor release. #2376
OCPBUGS-43454: Ignore cluster manager topology not managed errors for localnet with no subnets #2362
OCPBUGS-44303: Add hybird overlay pod IPs to the namespace address_set #2340
OCPBUGS-42931: Add static route to the hairpin masquerade IPs to pod #2315
OCPBUGS-39200: Dockerfile: Bump OVS to 3.4.0-1 #2287
OCPBUGS-42940: Fix egress gateway pod cleanup for remote zone pods. #2316
OCPBUGS-39406, SDN-4919: Downstream Merge 28th August #2283
SDN-4919: Downstream Merge August 22nd #2277
SDN-4919: Downstream Merge 20th August #2274
OCPBUGS-38267, OCPBUGS-38653, OCPBUGS-38693: Downstream Merge 14th August 2024 #2265
OCPBUGS-37541: Fix per-pod MCS/metadata blocking #2240
OCPBUGS-36614, OCPBUGS-36865, SDN-4919: [DownstreamMerge] 29 July 2024 #2241
OCPBUGS-37709: Revert #2233 DownStream Merge: 24th July 2024 #2243
OCPBUGS-36865, SDN-4919: DownStream Merge: 24th July 2024 #2233
SDN-4919: Downstream Merge July 10th #2223
OCPBUGS-33758, OCPBUGS-33758, OCPBUGS-35347, OCPBUGS-35367, SDN-4919, SDN-5011: Downstream Merge: July 2nd #2217
OCPBUGS-34463: Updating ovn-kubernetes-microshift-container image to be consistent with ART for 4.17 #2186
OCPBUGS-34778: bump OVN to fix multicast bug #2210
OCPBUGS-34462: Updating ose-ovn-kubernetes-container image to be consistent with ART for 4.17 #2191
OCPBUGS-33005: Downstream Merge June 17th #2206
SDN-4157: Downstream Merge June 7th 2024 #2201
OCPBUGS-34109: Updating ose-ovn-kubernetes-base-container image to be consistent with ART for 4.17 #2176
OCPBUGS-34331: [DownstreamMerge] 23 May 2024 #2180
OKD-40: Add ovnver_okd and ovsver_okd to Dockerfile.base #2161
Full changelog

powervs-block-csi-driver

OCPBUGS-80142: Fix CVE-2026-33186 by bumping google.golang.org/grpc to 1.79.3 #131
OCPBUGS-82725: Fix CVE-2026-35469 by bumping github.com/moby/spdystream to v0.5.1 #125
MULTIARCH-4809: Rebase with upstream: go modules updates and code changes. #86
OCPBUGS-35349: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.17 #84
OCPBUGS-34123: Updating ose-powervs-block-csi-driver-container image to be consistent with ART for 4.17 #83
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-80144: Fix CVE-2026-33186 by bumping google.golang.org/grpc to v1.79.3 #112
STOR-1596: Bump all deps for 4.17 #73
OCPBUGS-36229: Fix CVE-2023-45288 and CVE-2024-24786 #69
OCPBUGS-35871: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.17 #72
OCPBUGS-34219: Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.17 #71
Full changelog

powervs-cloud-controller-manager

OCPBUGS-80145: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 to v1.79.3 to fix CVE-2026-33186 #103
No-Jira: Manual rebase of upstream release 1.30 on 22-Jul-2024 #72
No-Jira: Add multiarch reviewers and approvers to OWNER file #70
No-Jira: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.29 (6c2ab88) into main #69
OCPBUGS-34864: Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.29 (5a0fb34) into main #41
OCPBUGS-34372: Updating ose-powervs-cloud-controller-manager-container image to be consistent with ART for 4.17 #68
Full changelog

powervs-machine-controllers

OCPBUGS-61204: Use OS_GIT_VERSION in Makefile when found (for Konflux builds) #126
append .0 to go.mod version #117
OCPBUGS-54750: Fix for CVE-2024-51744 in github.com/golang-jwt/jwt/v4 in release-4.17 #113
OCPBUGS-37688: Update go.mod to fix CVE #81
OCPBUGS-34379: Updating ose-powervs-machine-controllers-container image to be consistent with ART for 4.17 #78
OCPBUGS-33995: Add more custom endpoints #76
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #403
append .0 to go.mod version #381
MON-3972: [bot] Bump openshift/prom-label-proxy to v0.11.0 #375
MON-3905: [bot] Bump openshift/prom-label-proxy to v0.10.0 #373
MON-3897: [bot] Bump openshift/prom-label-proxy to v0.9.0 #372
OCPBUGS-34362: Updating prom-label-proxy-container image to be consistent with ART for 4.17 #371
OCPBUGS-34362: Updating prom-label-proxy-container image to be consistent with ART for 4.17 #370
Full changelog

prometheus

OCPBUGS-93681: fix for CVE-2026-42151 #378
NO-ISSUE: synchronize OWNERS from main branch #383
OCPBUGS-88631: remote: validate snappy decoded length before allocation in read endpoint #348
OCPBUGS-80146: Bump google.golang.org/grpc #320
OCPBUGS-61766: chore: compute highestTimestamp at queryManager level #268
append .0 to go.mod version #258
OCPBUGS-56738: BACKPORT: fix promtool analyze block shows metric name with 0 cardinality #254
OCPBUGS-54941: Scraping: Bump cache iteration after error to avoid false duplicate detection. #249
OCPBUGS-43667: fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers’ DeleteFunc #230
OCPBUGS-38690: Restore Prometheus functionality to accept samples with different timestamps from the same series in a single scrape. #221
MON-3914: [bot] Bump openshift/prometheus to v2.53.1 #215
OCPBUGS-37370: backport of upstream fix #216
OCPBUGS-37244: [bot] Bump openshift/prometheus to v2.53.1 #211
OCPBUGS-35483: cherry-pick upstream fix to make PrometheusRemoteWriteBehind fire when remote endpoint is never reached. #213
OCPBUGS-36768: cherry-pick upstream remote-write fix #210
MON-3914: [bot] Bump openshift/prometheus to v2.53.0 #208
MON-3914: [bot] Bump openshift/prometheus to v2.53.0 #206
OCPBUGS-34264: Updating golang-github-prometheus-prometheus-container image to be consistent with ART for 4.17 #205
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #196
OCPBUGS-103294: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #173
OCPBUGS-98167: bump github.com/hashicorp/memberlist to a forked version #166
OCPBUGS-100356: Set testdata CA expiry to 20 years from issue date (#4112) #151
OCPBUGS-75885: Include go-verify-deps expected files in gitignore #115
append .0 to go.mod version #102
OCPBUGS-34297: Updating golang-github-prometheus-alertmanager-contain… #93
OCPBUGS-33686: [bot] Bump openshift/prometheus-alertmanager to v0.27.0 #90
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #416
OCPBUGS-103296, OCPBUGS-103297: [release-4.17] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #399
OCPBUGS-77452: Validate webhookURL secret for MSTeams receiver in AlertmanagerConfig CRD #369
OCPBUGS-58408: Fix: One Alertmanager Config failing blocks all others. (#6585) #336
OCPBUGS-48069: fix: validate smtp smarthost and smtp from fields #323
OCPBUGS-38398: feat: sync proxy settings in Alertmanager configuration #296
MON-3947: Bump openshift/prometheus-operator to v0.75.2 #294
MON-3889: [bot] Bump openshift/prometheus-operator to v0.74.0 #287
OCPBUGS-34153, OCPBUGS-34308, OCPBUGS-34459: Updating prometheus-operator-container image to be consistent with ART for 4.17 #293
OCPBUGS-34308: Updating prometheus-config-reloader-container image to be consistent with ART for 4.17 #289
OCPBUGS-34153: Updating prometheus-operator-admission-webhook-container image to be consistent with ART for 4.17 #288
Full changelog

prometheus-node-exporter

OCPBUGS-103292: Use patched x/net fork v0.35.0-sec.4 #195
NO-ISSUE: synchronize OWNERS from main branch [release-4.17] #212
append .0 to go.mod version #167
MON-3949: [bot] Bump openshift/node_exporter to v1.8.2 #149
OCPBUGS-34124: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 4.17 #148
MON-3882: [bot] Bump openshift/node_exporter to v1.8.1 #146
OCPBUGS-34124: Updating golang-github-prometheus-node_exporter-container image to be consistent with ART for 4.17 #147
Full changelog

route-controller-manager

OCPBUGS-103135: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #111
OCPBUGS-80022: Bump google.golang.org/grpc to v1.79.3 #86
OCPBUGS-55943: Added error event for failed ingress to route conversion #60
OCPBUGS-53077: ingress: Reset metrics when ingress is deleted #57
WRKLDS-1292: bump(k8s.io)=1.30.1 #44
OCPBUGS-34146: Updating ose-route-controller-manager-container image to be consistent with ART for 4.17 #43
OCPBUGS-34146: Updating ose-route-controller-manager-container image to be consistent with ART for 4.17 #42
Full changelog

service-ca-operator

OCPBUGS-68220: Update logrus to 1.9.3 to address CVE-2025-65637 #316
Fix for OCPBUGS-68221: CVE-2025-65637 bump github.com/sirupsen/logrus to v1.9.3 #309
append .0 to go.mod version #266
OCPBUGS-34228: Updating ose-service-ca-operator-container image to be consistent with ART for 4.17 #261
NO-JIRA: fix outdated doc links #241
Full changelog

telemeter

OCPBUGS-81796: [release-4.17] Fix CVE-2026-34986 #597
OCPBUGS-80159: Bump google.golang.org/grpc to v1.79.3 #600
ART-13124: Update go.mod to include patch version in go directive #562
OCPBUGS-33285: Add metricsclient_http_requests_total metric #500
MON-3890: add recording rule acm_capacity_effective_cpu_cores #534
OCPBUGS-34833: fix issuer check during JWT authentication #536
OCPBUGS-34431: Updating telemeter-container image to be consistent with ART for 4.17 #533
OCPBUGS-34039: Updating telemeter-container image to be consistent with ART for 4.17 #532
Full changelog

tests

OCPBUGS-130857: stage the creation of test pods to minimize etcd impact #31741
OCPBUGS-65492: Add imagestream update dryrun test #30479
OCPBUGS-64927: update telemtery limit for 4.17 e2e case #30472
OCPBUGS-64641: Migrate OCP-32383 to upstream #30455
OCPBUGS-63392: Backport pr 29834 to release-4.18 #30408
OCPBUGS-61162: images/tests: Remove rteval #30202
NO-JIRA: Update extended/networking OWNERS #30090
OCPBUGS-57324: Fix bearer token exposure in exit condition as well #29910
OCPBUGS-57888: Bump to Kubernetes v1.30.14 #29983
OCPBUGS-50664: Replace RunHostCmd with Exec function to censor bearer token being exposed #29539
OCPBUGS-56221: aws/edge: prevent test using unschedulable nodes #29792
OCPBUGS-55451: support provider type external #29737
OCPBUGS-55269: Bump to Kubernetes v1.30.12 #29771
OCPBUGS-55498: [build] Ensure Git Clone Does Not Run Privileged #29743
OCPBUGS-54767: Fix egress firewall tests by updating the URL from docs.openshift.com to redhat.com #29660
OCPBUGS-52580: Use payload pullspec for image info test #29588
OCPBUGS-38835: Try also user CA for getting openshift-tests image #29029
OCPBUGS-49411: Add a monitor test to detect concurrent installer pod or static pod #29487
OCPBUGS-48634: Revert “[release-4.17] OCPBUGS-48459, SDN-4930: ovn-k, udn crd e2e: Fix status report consumer assertion” #29453
OCPBUGS-48459, SDN-4930: ovn-k, udn crd e2e: Fix status report consumer assertion #29301
OCPBUGS-48345: Add team members to the OWNERS file for PR approvals #29430
OCPBUGS-48188: Fixing build s2i ruby test data inline with latest ruby version(>=3.0) #29409
: OCPBUGS-48093: fix unit test for compare against string #29405
OCPBUGS-44190: Fix UnexpectedNodeNotReady and UnexpectedNodeUnreachable #29306
OCPBUGS-43576, SDN-4930: Don’t modify pod routes in tests #29250
OCPBUGS-43576, SDN-4930: Set startup probe for UDN tests #29244
OCPBUGS-43576, SDN-4930: UserDefinedPrimaryNetworks: curl the KAPI IP through eth0 #29241
OCPBUGS-44795: fix: adding oslat updates and outputting test results to the artifacts #29193
OCPBUGS-43576, SDN-4930: network_segmentation: allow multiple UDN status conditions #29259
OCPBUGS-44494: removing rteval from the realtime test suite #29194
OCPBUGS-44496: fix: adding in a SNO time override for AWS Metal #29192
OCPBUGS-44062: Adjust createDNSPod() to support hypershift dual-stack test #29254
OCPBUGS-44045: Ignore infra nodes on tap cni tests #29251
OCPBUGS-43569: feat: update to use pullspec image #29207
OCPBUGS-43576: Porting testing for netConfig and UDN and CIDR overlapping tests from upstream #29181
OCPBUGS-39606: Add image registry capability check #29174
OCPBUGS-42814: ruby:3.0-ubi8 => ruby:3.1-ubi8 #29162
OCPBUGS-42336: Fix image ecosystem tests 4.17 #29126
OCPBUGS-41817: Update the NotFound case for CNI plugin to reflect changes #29091
OCPBUGS-39134: Bump timeout for the pod-network-service endpoints check #29051
OCPBUGS-38674: add unexpected ready for monitor tests #29021
OCPBUGS-39254: Change Operator Installed for Smoke Test #29055
OCPBUGS-39031: kube-apiserver rollout: wait for stability before exiting #29047
OCPBUGS-38446: NetworkSegmentation tests: fix the IPv6 node IP detection #29005
NO-JIRA: create a test that repeatedly rolls out the kube-apiserver and uses m… #28986
NO-JIRA: drop ocp-storage exceptions for termination policy #28793
STOR-1819: Add OpenShift specific CSI certification test #28967
TRT-1723: riskanalysis: pass along errors from API request #28984
SDN-4919: NetworkSegmentation: Add tests for EndpointSlices mirror controller #28945
OCPEDGE-1033: fix: making oslat test more dynamic to handle different cpu sets #28980
OCPEDGE-1182: fix: remove un-needed test #28979
TRT-1688: Revert “allow etcd log test to flake under vsphere” #28978
OCPBUGS-37837: vertical scaling test should not rely on CPMS replicas #28969
OCPBUGS-37986: Revert #28944 “ Reapply \“Merge pull request #28277 from vrutkovs/in-cluster-fixes-v3\ #28977
IR-471: Skipping chunksizemib tests #28975
OCPBUGS-37245: Ignore pod sandbox adds expected to fail #28973
OCPBUGS-18865: Reapply “Merge pull request #28277 from vrutkovs/in-cluster-fixes-v3” #28944
NO-JIRA: Disable:Broken for [sig-builds][Feature:Builds][Slow] can use private repositories as build input build using an HTTP token should be able to clone source code via an HTTP token [apigroup:build.openshift.io] #28968
NO-JIRA: riskanalysis: improve request retries #28961
SDN-4919: Skip network segmentation tests #28964
NO-ISSUE: Automated - Update synthetic test data #28954
OCPBUGS-37675: Add a version command to openshift-tests #28960
NO-ISSUE: Use external binary name on retry #28955
OCPBUGS-35880: fix pod not returning success on ‘Managed cluster should verify that nodes have no unexpected reboots’ #28953
OCPEDGE-1181: bump(ocp/k8s): updating to pull in annotation fix for SNO conformance test #28948
IR-471: Updating the test with skipper function #28947
no-jira: e2e: mark tests as [apigroup:apps.openshift.io] dependent #28951
NO-JIRA: Revert “pathologicalevents: Ignore leaky RecreatingTerminatedPod” #28950
SDN-5133: Add udn test framework #28933
NO-ISSUE: Automated - Update synthetic test data #28914
OCPBUGS-37436: increase telemetry series permitted avg threshold #28943
TRT-1702: record risk analysis results in BQ #28926
OCPBUGS-37411: Revert #28277 “OCPBUGS-18865: add monitortest: in-cluster disruption monitors” #28942
no-jira: e2e: check for deployer RB only when DeploymentConfig is enabled #28941
no-jira: e2e: check for deployer SA only when DeploymentConfig is enabled #28939
OCPBUGS-18865: add monitortest: in-cluster disruption monitors #28277
OCPBUGS-36742: Sync imports #28929
OCPEDGE-1125: upkeep: add better logging for crio failures #28852
NO-JIRA: egressfirewall: skip ping tests in case of hypershift kubevirt on Azure infra #28916
IR-471: Add test for ChunkSizeMiB configuration for Registry #28932
STOR-1961: Fix vSphereDriverConfiguration tests #28936
NO-JIRA: Fail on APIs removed in the next release #28240
OCPBUGS-36672: Shorten stabilization time for etcd profiles test #28930
API-1802: watchevents: add cert rotation events #28639
OCPBUGS-34902: Revert “NO-JIRA: test: skip crio test for rt runs” #28918
OCPBUGS-36403: test/extended/util/openshift/clusterversionoperator/adminack: No nested framework.Fail #28917
NO-JIRA: Always try to pull the the in-cluster test binary #28900
NO-JIRA: fix: update skip logic for watchdog #28920
ETCD-611: update cert rotation tests #28890
Use ephemeral cluster docker config.json for test binary extraction #28873
OCPBUGS-36263: Expand allowance for kubelet metrics api endpoint outages during node upgrades #28911
USHIFT-3455: Skip legacy-etcd monitor tests in microshift #28874
OCPEDGE-800: feat: add SNO upgrade consideration during pathological errors #28903
OCPBUGS-34475: remove unused in-cluster monitoring code #28908
OCPBUGS-36187: Revert #28515 Re-enable test/extended/router/http2 tests on AWS” #28905
OCPBUGS-33486: Removes dependency on samples operator images #28840
OCPBUGS-26601: Re-enable test/extended/router/http2 tests on AWS #28515
NO-ISSUE: Automated - Update synthetic test data #28897
TRT-1718: Add new intervals for kubelet metrics endpoints down #28896
NO-JIRA: Add display flag to the primary EtcdLeadership intervals #28861
OCPEDGE-1157: fix: resolve serial operator availability #28893
OCPBUGS-35535: add Proxy config #28880
Revert “TRT-1691: Revert #28735 “TRT-1576: Fail if operator has Available=False unless in upgrade window”” #28851
USHIFT-3455: Add apigroup to skip a FeatureGate test in MicroShift #28875
NO-ISSUE: fix the node reboot test to actually run #28884
ETCD-578: Fix etcd profiles e2e test to check returned status for upd… #28836
NO-JIRA: use lib-go version of the markdown interface #28707
ETCD-606: Open up the RequiredInstallerResourcesMissing test to more resources. #28866
OCPBUGS-34448: monitortestframework: unsupported monitors should warn, not error #28865
OCPBUGS-34468: art consistency openshift 4.17 openshift enterprise tests custom #28876
trt-1689: Filter must-gather and truncate system node users #28856
API-1783: bump(k8s.io/kubernetes) #28869
NO-ISSUE: Automated - Update synthetic test data #28867
API-1783: Rebase 1.30 #28829
OCPBUGS-33497: Add a “limit” exception for iptables-alerter #28858
TRT-1688: allow test to flake under vsphere #28855
NO-JIRA: test: skip crio test for rt runs #28854
API-1783: Conditionally skip tests to help with k8s 1.30 #28850
STOR-1839: correct feature gate annotation for vsphere snapshot test #28846
OCPBUGS-34666: Update etcd test data for 1.30 release #28843
TRT-1691: Revert #28735 “TRT-1576: Fail if operator has Available=False unless in upgrade window” #28847
TRT-1576: Fail if operator has Available=False unless in upgrade window #28735
TRT-1218: Add the display flag for interval Sources that should have them #28816
TRT-1686: Reduce logging of podspec in the PodsStreamer #28833
OCPBUGS-34403: Only look for thanos connections to platform monitoring stack #28825
NO-ISSUE: Automated - Update synthetic test data #28811
OCPBUGS-34346: Regenerate TLS info #28657
API-1783: Conditionally skip tests to help with k8s 1.30 #28832
ETCD-565: add manual etcd signer cert rotation e2e test #28684
TRT-1653: Fix regexes for now quoted podUID in system journal log parsing #28804
ETCD-578: remove Tech Preview check from etcd profiles e2e test #28817
OCPBUGS-33944: Fix regex parser for censoring private key #28813
NO-JIRA: fix: update test to use IsSingleNode func #28801
NO-JIRA: Drop Cluster Infra related exceptions from termination message policy tests #28798
API-1783: Conditionally skip tests to help with k8s 1.30 #28814
CFE-853: e2e test case for DNSNameResolver and EgressFirewall integration #28683
NO-JIRA: quota.sh: 4.16 no longer creates legacy API tokens #28808
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

thanos

OCPBUGS-80161: Bump google.golang.org/grpc to v1.79.3 #185
append .0 to go.mod version #161
OCPBUGS-34088: Updating ose-thanos-container image to be consistent with ART for 4.17 #148
MON-3887: [bot] Bump openshift/thanos to v0.35.1 #147
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-103318: Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.17 #136
OCPBUGS-78027: hermetic migration 4.17 #106
OCPBUGS-43432: update check-fmt goimports command #78
OCPBUGS-37661: Bump otelgrpc to v0.53.0 #74
NO-JIRA: Update OWNERS #69
OCPBUGS-34626, OCPCLOUD-2605: Merge https://github.com/kubernetes/cloud-provider-vsphere:master (b087162) into master #62
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-80165: Bump google.golang.org/grpc to v1.79.3 #105
OCPBUGS-78019: hermetic migration 4.17 #85
OCPBUGS-61652: Fix unit tests #71
NO-JIRA: Update OWNERS #47
OCPBUGS-34179, OCPCLOUD-2623: Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.10.0 (41eeb09) into master #44
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-92391: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.6 #232
OCPBUGS-103314, OCPBUGS-103319: Use patched x/net fork v0.35.0-sec.4 #209
OCPBUGS-92852: Bump golang.org/x/crypto/ssh to v0.33.0-sec.3 #194
OCPBUGS-80168: Bump google.golang.org/grpc #177
OCPBUGS-68224: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #157
OCPBUGS-43705: redact sensitive information when logging VCenter config #133
OCPBUGS-34114: Updating vmware-vsphere-syncer-container image to be consistent with ART for 4.17 #125
OCPBUGS-34099: Updating ose-vmware-vsphere-csi-driver-container image to be consistent with ART for 4.17 #124
STOR-1600: Rebase against v3.2.0 #122
Full changelog

vsphere-csi-driver-operator

OCPBUGS-103315: Bump golang.org/x/net to v0.35.0-sec.3 #357
OCPBUGS-52207: fix panic when vcenter address is incorrect #295
OCPBUGS-50593: Set reconcile-sync to 10 minute for ListVolume #291
OCPBUGS-49858: Escape backslash in vCenter username #288
OCPBUGS-49685: List only linux nodes #285
OCPBUGS-43778: Fix panic on nil infrastructure Spec.PlatformSpec.VSphere #264
OCPBUGS-42327: Fix the config loading warning #259
OCPBUGS-42007: Remove conditions and controllers #254
OCPBUGS-42006: Add check for vCenter version #253
OCPBUGS-42008: Implement minor quality of life improvements. #255
OCPBUGS-38442: Restart CSI driver controller pod on config change #247
OCPBUGS-37772: Disable CSI migration in multi-vCenter cluster #243
SPLAT-1637: Initial changes for multi vcenter support. #228
STOR-1593: Disable toplogy feature explicitly #241
STOR-1949: Add cns migration #242
STOR-1596: Bump all deps for 4.17 #236
STOR-1767: Delete resources if spec.ManagementState is equal to Removed for removable CSI drivers #233
OCPBUGS-37201: Make sure credentials are wrapped in double quotes #239
OCPBUGS-37201: Ignore comment symbols when reading the ini file #238
STOR-1290: don’t pass credentials via environment variables in vSphere #227
OCPBUGS-34234: Updating ose-vmware-vsphere-csi-driver-operator-container image to be consistent with ART for 4.17 #232
Full changelog

vsphere-problem-detector

OCPBUGS-103317: Bump golang.org/x/net to v0.35.0-sec.4 #234
OCPBUGS-84085: fix concurrent map writes #216
OCPBUGS-61755: Check for number of FailureDomain-s in GetVCenter() #190
SPLAT-1658: Add multi vCenter support #158
STOR-1767: Silence vsphere-problem-detector if State is Removed #169
STOR-1767: Make checks less frequent if State is Removed in ClusterCSIDriver #166
STOR-1596: Bump all deps for 4.17 #163
OCPBUGS-34563: Drop event when CheckDefaultDatastore fails #165
OCPBUGS-34176: Updating ose-vsphere-problem-detector-container image to be consistent with ART for 4.17 #164
OCPBUGS-35215: Fix missing failure-domains #159
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github